@inetafrica/open-claudia 2.15.0 → 3.0.0

package/test-approval-async.js

@@ -7,6 +7,7 @@ const assert = require("assert");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const { spawn } = require("child_process");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "approval-async-test-"));
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
@@ -48,6 +49,30 @@ const approvals = require("./core/approvals");
   assert.strictEqual(replay.ok, false, "second consume refused (single use)");
   assert.ok(/already consumed/.test(replay.reason));
 
+  const concurrent = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(concurrent.id, "approved", "c1");
+  const consumeInChild = () => new Promise((resolve, reject) => {
+    const source = [
+      `const approvals = require(${JSON.stringify(path.join(__dirname, "core", "approvals.js"))});`,
+      `process.stdout.write(JSON.stringify(approvals.consume(${JSON.stringify(concurrent.id)}, ${JSON.stringify(CMD)})));`,
+    ].join("\n");
+    const child = spawn(process.execPath, ["-e", source], {
+      env: { ...process.env, APPROVALS_DIR: approvals.APPROVALS_DIR },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      if (code !== 0) reject(new Error(stderr || `approval child exited ${code}`));
+      else resolve(JSON.parse(stdout));
+    });
+  });
+  const concurrentResults = await Promise.all([consumeInChild(), consumeInChild()]);
+  assert.strictEqual(concurrentResults.filter((result) => result.ok).length, 1, "concurrent redemption has exactly one winner");
+
   // ── unknown id fails closed ──
   assert.strictEqual(approvals.consume("apr_nope", CMD).ok, false, "unknown id refused");
 
@@ -62,11 +87,45 @@ const approvals = require("./core/approvals");
   assert.strictEqual(expired.ok, false, "expired token refused");
   assert.ok(/expired/.test(expired.reason));
 
-  // ── long commands: stored payload is capped at 1000 chars and matching respects the cap ──
-  const longCmd = "open-claudia tool run fleet purge " + "x".repeat(1200);
-  const lrec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: longCmd, channelId: "c1", adapter: "tg" });
+  // ── command binding: the whole visible payload is hashed. Commands too long
+  // to display completely are rejected rather than approving a hidden suffix.
+  const boundCmd = "open-claudia tool run fleet purge " + "x".repeat(400);
+  const lrec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: boundCmd, channelId: "c1", adapter: "tg" });
+  assert.strictEqual(lrec.command, boundCmd, "the exact approved command is retained");
+  assert.match(lrec.commandHash, /^[a-f0-9]{64}$/, "the approval carries a full-payload digest");
   approvals.decide(lrec.id, "approved", "c1");
-  assert.strictEqual(approvals.consume(lrec.id, longCmd).ok, true, "capped command still matches its own approval");
+  const changedSuffix = `${boundCmd.slice(0, -8)}DIFFERENT`;
+  assert.strictEqual(approvals.consume(lrec.id, changedSuffix).ok, false, "a suffix mismatch is refused");
+  assert.strictEqual(approvals.consume(lrec.id, boundCmd).ok, true, "the full exact command still redeems");
+  assert.throws(
+    () => approvals.create({ tool: "fleet", command: "open-claudia tool run fleet purge " + "x".repeat(1200) }),
+    (error) => error && error.code === "APPROVAL_PAYLOAD_TOO_LARGE",
+    "an approval never hides an undisplayed command suffix",
+  );
+
+  const legacy = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(legacy.id, "approved", "c1");
+  const legacyFile = path.join(approvals.APPROVALS_DIR, `${legacy.id}.json`);
+  const legacyRecord = JSON.parse(fs.readFileSync(legacyFile, "utf8"));
+  delete legacyRecord.commandHash;
+  fs.writeFileSync(legacyFile, JSON.stringify(legacyRecord));
+  assert.strictEqual(approvals.consume(legacy.id, CMD).ok, true, "safe short pre-hash approvals remain redeemable");
+
+  const unsafeLegacy = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(unsafeLegacy.id, "approved", "c1");
+  const unsafeLegacyFile = path.join(approvals.APPROVALS_DIR, `${unsafeLegacy.id}.json`);
+  const unsafeLegacyRecord = JSON.parse(fs.readFileSync(unsafeLegacyFile, "utf8"));
+  delete unsafeLegacyRecord.commandHash;
+  unsafeLegacyRecord.command = "x".repeat(600);
+  fs.writeFileSync(unsafeLegacyFile, JSON.stringify(unsafeLegacyRecord));
+  assert.strictEqual(
+    approvals.consume(unsafeLegacy.id, unsafeLegacyRecord.command).ok,
+    false,
+    "legacy approvals with an undisplayed suffix require a fresh decision",
+  );
+
+  const quotedCommand = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "purge", "node one", "it's-safe"]);
+  assert.strictEqual(quotedCommand, "open-claudia tool run fleet purge 'node one' 'it'\"'\"'s-safe'");
 
   // ── waitForDecision default fast-path window is 90s (not the old 5 min) ──
   const src = fs.readFileSync(path.join(__dirname, "core", "approvals.js"), "utf-8");

package/test-cursor-removal.js

@@ -0,0 +1,334 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const root = __dirname;
+const fixturesRoot = path.join(root, "test-fixtures", "migrations");
+
+function fixture(name, file) {
+  return JSON.parse(fs.readFileSync(path.join(fixturesRoot, name, file), "utf8"));
+}
+
+function cursorArchiveMigrationProbe(stateApi, jobsApi) {
+  assert.ok(stateApi.STATE_SCHEMA_VERSION >= 3, "removed-provider state requires a new schema version");
+  assert.ok(stateApi.SESSIONS_SCHEMA_VERSION >= 3, "removed-provider sessions require a new schema version");
+
+  const stateDoc = stateApi.migrateStateDocument(fixture("cursor-selected", "state.json"), {
+    defaultUserId: "telegram:fixture",
+    canonicalizeUserId: (value) => String(value),
+  });
+  const state = stateDoc.users["telegram:fixture"];
+  assert.strictEqual(state.settings.backend, null, "a removed provider selection must not fall through to Claude or Codex");
+  assert.strictEqual(state.legacyProviderState.providerSelectionRequired, true);
+  assert.strictEqual(state.legacyProviderState.archivedBackend, "cursor");
+  assert.strictEqual(state.legacyProviderState.archivedSessionPointers.cursor, "cursor-session-unresolved");
+  assert.strictEqual(state.legacyProviderState.archivedActiveSessions["legacy-cursor"].cursor, "cursor-session-unresolved");
+  assert.strictEqual(state.legacyProviderState.archivedProviderSettings.cursor.model, "cursor-model");
+  assert.ok(!Object.values(state.activeSessions).some((providers) => Object.prototype.hasOwnProperty.call(providers, "cursor")));
+  assert.ok(!Object.prototype.hasOwnProperty.call(state.providerSettings, "cursor"));
+  assert.deepStrictEqual(stateApi.migrateStateDocument(stateDoc, {
+    defaultUserId: "telegram:fixture",
+    canonicalizeUserId: (value) => String(value),
+  }), stateDoc, "removed-provider state migration is idempotent");
+
+  const sessions = stateApi.migrateSessionsDocument(fixture("cursor-selected", "sessions.json"), {
+    defaultUserId: "telegram:fixture",
+    canonicalizeUserId: (value) => String(value),
+    ownsSession: () => true,
+  });
+  const ambiguous = sessions.users["telegram:fixture"]["legacy-cursor"][0];
+  assert.strictEqual(ambiguous.id, "cursor-or-claude-ambiguous");
+  assert.strictEqual(ambiguous.provider, "legacy");
+  assert.strictEqual(ambiguous.selectable, false);
+
+  const explicit = stateApi.migrateSessionsDocument({
+    schemaVersion: 2,
+    users: { "telegram:fixture": { "legacy-cursor": [{ id: "cursor-explicit", provider: "cursor", title: "Archived" }] } },
+  }, {
+    defaultUserId: "telegram:fixture",
+    canonicalizeUserId: (value) => String(value),
+    ownsSession: () => true,
+  });
+  const record = explicit.users["telegram:fixture"]["legacy-cursor"][0];
+  assert.strictEqual(record.provider, "legacy");
+  assert.strictEqual(record.archivedProvider, "cursor");
+  assert.strictEqual(record.selectable, false);
+  assert.strictEqual(record.legacyResolution, "removed-provider");
+
+  const jobs = jobsApi.migrateJobsDocument(fixture("cursor-selected", "jobs.json"), {
+    defaultCanonicalUserId: "telegram:fixture",
+    defaultChannelId: "fixture-channel",
+    defaultAdapter: "telegram-fixture",
+    defaultAdapterType: "telegram",
+    now: () => 1_720_000_000_000,
+  });
+  assert.strictEqual(jobs.jobs.length, 0);
+  assert.strictEqual(jobs.archived[0].provider, "cursor");
+  assert.strictEqual(jobs.archived[0].sessionId, "cursor-session-unresolved");
+  assert.strictEqual(jobs.archived[0].disabled, true);
+  assert.ok(!jobs.archived.some((job) => ["claude", "codex"].includes(job.provider)));
+}
+
+function migrationOrderingAndRollbackProbe(migrationApi) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-cursor-removal-"));
+  try {
+    const configDir = path.join(temp, "config");
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.cpSync(path.join(fixturesRoot, "cursor-selected"), configDir, { recursive: true });
+    const sources = migrationApi.defaultMigrationSources({ configDir });
+    const originals = new Map(sources.map((source) => [
+      source.path,
+      fs.existsSync(source.sourcePath) ? fs.readFileSync(source.sourcePath) : null,
+    ]));
+    const snapshot = migrationApi.ensureMigrationSnapshot({ configDir, sources });
+    migrationApi.markMigrationComponentPrepared(snapshot.snapshotDir, "state", { configDir, sources });
+    assert.throws(
+      () => migrationApi.markMigrationComponentActivated(snapshot.snapshotDir, "state", { configDir, sources }),
+      (error) => error.code === "MIGRATION_COMPONENT_NOT_MIGRATED",
+      "unchanged legacy state cannot be falsely marked activated",
+    );
+
+    const runUpgrade = () => spawnSync(process.execPath, ["-e", [
+      "const migration = require('./core/provider-migration');",
+      "const result = migration.completeProviderMigration();",
+      "const fs = require('fs');",
+      "const path = require('path');",
+      "const dir = process.env.OPEN_CLAUDIA_CONFIG_DIR;",
+      "const state = JSON.parse(fs.readFileSync(path.join(dir, 'state.json'), 'utf8'));",
+      "const sessions = JSON.parse(fs.readFileSync(path.join(dir, 'sessions.json'), 'utf8'));",
+      "const jobs = JSON.parse(fs.readFileSync(path.join(dir, 'jobs.json'), 'utf8'));",
+      "process.stdout.write(JSON.stringify({ result, state, sessions, jobs }));",
+    ].join("\n")], {
+      cwd: root,
+      env: {
+        HOME: path.join(temp, "home"),
+        PATH: [path.dirname(process.execPath), "/usr/bin", "/bin"].join(path.delimiter),
+        OPEN_CLAUDIA_CONFIG_DIR: configDir,
+        WORKSPACE: path.join(temp, "workspace"),
+        CHANNELS: "",
+        TELEGRAM_CHAT_ID: "fixture",
+        OPEN_CLAUDIA_TEST: "1",
+      },
+      encoding: "utf8",
+      timeout: 30000,
+    });
+    fs.mkdirSync(path.join(temp, "home"), { recursive: true });
+    fs.mkdirSync(path.join(temp, "workspace"), { recursive: true });
+    const first = runUpgrade();
+    assert.strictEqual(first.status, 0, first.stderr || first.stdout);
+    const upgraded = JSON.parse(first.stdout);
+    assert.strictEqual(upgraded.state.schemaVersion, 3);
+    const migratedState = upgraded.state.users["telegram:fixture"];
+    assert.strictEqual(migratedState.settings.backend, null);
+    assert.strictEqual(migratedState.legacyProviderState.archivedBackend, "cursor");
+    assert.strictEqual(migratedState.legacyProviderState.providerSelectionRequired, true);
+    assert.ok(!Object.values(migratedState.activeSessions).some((bucket) => bucket.cursor));
+    assert.strictEqual(upgraded.sessions.schemaVersion, 3);
+    const session = upgraded.sessions.users["telegram:fixture"]["legacy-cursor"][0];
+    assert.strictEqual(session.provider, "legacy");
+    assert.strictEqual(session.selectable, false);
+    assert.strictEqual(upgraded.jobs.schemaVersion, 2);
+    assert.strictEqual(upgraded.jobs.jobs.length, 0);
+    assert.strictEqual(upgraded.jobs.archived[0].provider, "cursor");
+    assert.strictEqual(upgraded.jobs.archived[0].disabled, true);
+    assert.ok(upgraded.jobs.archived.some((job) => job.id === "legacy-cron" && job.disabled === true));
+    assert.strictEqual(upgraded.jobs.legacyCronMigration.status, "archived");
+    assert.strictEqual(upgraded.jobs.legacyCronMigration.recordCount, 1,
+      "provider-removal readiness includes every active legacy cron record");
+
+    const second = runUpgrade();
+    assert.strictEqual(second.status, 0, second.stderr || second.stdout);
+    assert.deepStrictEqual(JSON.parse(second.stdout), upgraded, "pre-runtime migration is restart-idempotent");
+
+    const ready = migrationApi.requireProviderRemovalReady({ configDir, sources });
+    assert.strictEqual(ready.journal.stage, "activated");
+    assert.deepStrictEqual(Object.keys(ready.journal.components).sort(), ["jobs", "sessions", "state"]);
+    for (const component of Object.values(ready.journal.components)) {
+      assert.match(component.sha256, /^[a-f0-9]{64}$/);
+      assert.ok(component.schemaVersion >= 2);
+      assert.ok(component.path.endsWith(".json"));
+    }
+    migrationApi.validateMigrationSnapshot(snapshot.snapshotDir);
+
+    for (const source of sources) {
+      fs.mkdirSync(path.dirname(source.sourcePath), { recursive: true });
+      fs.writeFileSync(source.sourcePath, `mutated:${source.path}\n`);
+    }
+    migrationApi.rollbackMigrationSnapshot(snapshot.snapshotDir, { configDir, sources });
+    for (const source of sources) {
+      const original = originals.get(source.path);
+      assert.strictEqual(fs.existsSync(source.sourcePath), original !== null, `${source.path}: original presence restored`);
+      if (original !== null) assert.deepStrictEqual(fs.readFileSync(source.sourcePath), original, `${source.path}: original bytes restored`);
+    }
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+
+  const blocked = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-cursor-removal-blocked-"));
+  try {
+    const configDir = path.join(blocked, "config");
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.cpSync(path.join(fixturesRoot, "cursor-selected"), configDir, { recursive: true });
+    const sources = migrationApi.defaultMigrationSources({ configDir });
+    migrationApi.ensureMigrationSnapshot({ configDir, sources });
+    assert.throws(
+      () => migrationApi.requireProviderRemovalReady({ configDir, sources }),
+      (error) => error.code === "PROVIDER_REMOVAL_NOT_READY",
+    );
+  } finally {
+    fs.rmSync(blocked, { recursive: true, force: true });
+  }
+}
+
+async function callbackCompatibilityProbe(actionsApi) {
+  assert.strictEqual(typeof actionsApi.isRemovedProviderCallback, "function");
+  assert.strictEqual(typeof actionsApi.handleRemovedProviderCallback, "function");
+  for (const payload of ["be:cursor", "mb:cursor", "mb:cursor:composer-2"]) {
+    assert.strictEqual(actionsApi.isRemovedProviderCallback(payload), true);
+    const state = {
+      settings: { backend: "codex" },
+      activeSessions: { alpha: { codex: "thread-alpha" } },
+      providerSettings: { codex: { model: "gpt" } },
+    };
+    const before = structuredClone(state);
+    const sent = [];
+    const handled = await actionsApi.handleRemovedProviderCallback(payload, async (text) => { sent.push(text); });
+    assert.strictEqual(handled, true);
+    assert.deepStrictEqual(state, before, "legacy callback compatibility cannot mutate provider state");
+    assert.strictEqual(sent.length, 1);
+    assert.match(sent[0], /older Open Claudia release/i);
+    assert.match(sent[0], /support has been removed/i);
+    assert.match(sent[0], /\/backend/);
+  }
+  assert.strictEqual(actionsApi.isRemovedProviderCallback("be:claude"), false);
+  assert.strictEqual(actionsApi.isRemovedProviderCallback("mb:codex:gpt-5"), false);
+}
+
+function noFallbackProbe(runContextApi, configApi) {
+  const state = {
+    userId: "fixture-user",
+    currentSession: { name: "alpha", dir: "/workspace/alpha" },
+    settings: { backend: "cursor" },
+    activeSessions: { alpha: {} },
+    providerSettings: {},
+  };
+  assert.throws(
+    () => runContextApi.captureRunContext({ state, prompt: "must not fall through", cwd: "/workspace/alpha" }),
+    (error) => error.code === "REMOVED_PROVIDER",
+  );
+  assert.throws(
+    () => configApi.discoverProviderExecutable("cursor"),
+    (error) => error.code === "UNKNOWN_PROVIDER",
+  );
+}
+
+function backupClassificationProbe(migrationApi) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-cursor-classification-"));
+  try {
+    const configDir = path.join(temp, "config");
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.writeFileSync(path.join(configDir, "state.json"), JSON.stringify({
+      schemaVersion: 2,
+      users: {
+        owner: {
+          settings: { backend: "claude" },
+          activeSessions: { alpha: { cursor: "cursor-transitional-session" } },
+          providerSettings: { cursor: { model: "cursor-transitional-model" } },
+        },
+      },
+    }));
+    fs.writeFileSync(path.join(configDir, "sessions.json"), JSON.stringify({
+      schemaVersion: 2,
+      users: { owner: { alpha: [{ id: "cursor-explicit-session", provider: "cursor" }] } },
+    }));
+    fs.writeFileSync(path.join(configDir, "jobs.json"), "[]\n");
+    const snapshot = migrationApi.ensureMigrationSnapshot({ configDir, sources: migrationApi.defaultMigrationSources({ configDir }) });
+    const entries = new Map(snapshot.manifest.files.map((entry) => [entry.path, entry]));
+    assert.match(entries.get("state.json").schemaGuess, /cursor/i);
+    assert.strictEqual(entries.get("state.json").resolution, "unresolved");
+    assert.match(entries.get("sessions.json").schemaGuess, /cursor/i);
+    assert.strictEqual(entries.get("sessions.json").resolution, "unresolved");
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+function semanticStaticProbe() {
+  const activeFiles = [
+    "core/config.js",
+    "core/state.js",
+    "core/run-context.js",
+    "core/system-prompt.js",
+    "core/runner.js",
+    "core/handlers.js",
+    "core/doctor.js",
+    "web.js",
+    ".env.example",
+  ];
+  const source = Object.fromEntries(activeFiles.map((file) => [file, fs.readFileSync(path.join(root, file), "utf8")]));
+
+  const forbidden = {
+    "core/config.js": [/CURSOR_PATH/, /resolvedCursorPath/, /cursor:\s*["']agent["']/, /providerId\s*===\s*["']cursor["']/],
+    "core/state.js": [/SELECTABLE_SESSION_PROVIDERS[^\n]*cursor/, /Object\.defineProperty\(state,\s*["']cursorSessionId["']/],
+    "core/run-context.js": [/return\s+["']cursorSessionId["']/],
+    "core/system-prompt.js": [/state\.cursorSessionId/, /provider\s*===\s*["']cursor["']/],
+    "core/runner.js": [/legacyCursorProvider/, /createLegacyCursorProvider/, /buildCursorArgs/, /discoverProviderExecutable\(["']cursor["']\)/, /settings\.backend\s*===\s*["']cursor["']/],
+    "core/handlers.js": [/name:\s*["']cursor["']/, /callback_data:\s*["']be:cursor["']/, /callback_data:\s*["']mb:cursor:/, /discoverProviderExecutable\(["']cursor["']\)/],
+    "core/doctor.js": [/CURSOR_PATH/, /discoverProviderExecutable\(["']cursor["']\)/, /Cursor Agent/],
+    ".env.example": [/CURSOR_PATH/],
+  };
+  for (const [file, patterns] of Object.entries(forbidden)) {
+    for (const pattern of patterns) assert.doesNotMatch(source[file], pattern, `${file} retains active removed-provider support: ${pattern}`);
+  }
+
+  // CSS cursor declarations are presentation, not the removed provider.
+  assert.match(source["web.js"], /cursor:\s*pointer/);
+  const packageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+  assert.doesNotMatch(packageJson.description, /Cursor Agent/i);
+  const readme = fs.readFileSync(path.join(root, "README.md"), "utf8");
+  assert.doesNotMatch(readme, /Cursor Agent|CURSOR_PATH|\/cursor\b/i);
+  const channelDesign = fs.readFileSync(path.join(root, "docs", "CHANNEL_DESIGN.md"), "utf8");
+  assert.doesNotMatch(channelDesign, /runCursor|Cursor Agent/i);
+
+  // Required preservation exceptions.
+  assert.ok(fs.existsSync(path.join(root, ".cursor", "rules", "project.mdc")));
+  assert.match(fs.readFileSync(path.join(root, "soul.md"), "utf8"), /Cursor IDE/);
+  assert.match(fs.readFileSync(path.join(root, "docs", "MULTI_CHANNEL_PLAN.md"), "utf8"), /leaves cursor for args/);
+  assert.match(fs.readFileSync(path.join(root, "core", "providers", "env.js"), "utf8"), /CURSOR_API_KEY/);
+  assert.match(fs.readFileSync(path.join(root, "core", "migration-backup.js"), "utf8"), /cursorSessionId/);
+  assert.match(fs.readFileSync(path.join(root, "core", "jobs.js"), "utf8"), /cursorSessionId/);
+  assert.match(fs.readFileSync(path.join(root, "test-provider-registry.js"), "utf8"), /provider\("cursor"\)/);
+
+  const changelog = fs.readFileSync(path.join(root, "CHANGELOG.md"), "utf8");
+  assert.match(changelog.slice(0, 2500), /active Cursor Agent runtime support has been removed/i);
+  assert.match(changelog.slice(0, 2500), /rollback/i);
+}
+
+async function main() {
+  const migrationApi = require("./core/migration-backup");
+  const stateApi = require("./core/state");
+  const jobsApi = require("./core/jobs");
+  const runContextApi = require("./core/run-context");
+  const configApi = require("./core/config");
+  const registry = require("./core/providers");
+
+  assert.deepStrictEqual(registry.listProviders().map((provider) => provider.id), ["claude", "codex"]);
+  cursorArchiveMigrationProbe(stateApi, jobsApi);
+  migrationOrderingAndRollbackProbe(migrationApi);
+  backupClassificationProbe(migrationApi);
+  noFallbackProbe(runContextApi, configApi);
+  await callbackCompatibilityProbe(require("./core/actions"));
+  semanticStaticProbe();
+  console.log("cursor removal OK");
+}
+
+main().catch((error) => {
+  console.error(error.stack || error.message);
+  process.exit(1);
+});

package/test-enforcer.js

@@ -1,7 +1,7 @@
 // The independent guardrail (Phase 3.3/3.4). The enforcer vets every outbound
 // reply and every write/destructive action aimed at an EXTERNAL person against
 // the owner-authored mandate, using an isolated model call it can never be
-// talked out of. These tests stub that model (core/subagent) and the transport
+// talked out of. These tests stub that model (core/utility-agent) and the transport
 // (core/adapter-registry) so we can pin the security-critical behaviour with no
 // network: owner is a strict no-op, the guard fails CLOSED (error/unparseable →
 // escalate, never cached), identical vets are cached once, and an escalation
@@ -14,21 +14,31 @@ const path = require("path");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "enforcer-"));
 process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.OPEN_CLAUDIA_CONFIG_DIR = path.join(tmp, "config");
 process.env.ENTITIES_DIR = path.join(tmp, "entities");
 process.env.PEOPLE_FILE = path.join(tmp, "people.json");
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
+fs.mkdirSync(process.env.OPEN_CLAUDIA_CONFIG_DIR, { recursive: true });
 
 // ── stub the model (destructured at enforcer load) and the transport (lazily
 //    required in adapterFor) BEFORE requiring the enforcer. ──────────────────
-let subagentCalls = 0;
+let utilityCalls = 0;
 let lastOpts = null;
-let subagentResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
-const subagentPath = require.resolve("./core/subagent");
-require.cache[subagentPath] = {
-  id: subagentPath, filename: subagentPath, loaded: true,
+let utilityResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
+const utilityPath = require.resolve("./core/utility-agent");
+require.cache[utilityPath] = {
+  id: utilityPath, filename: utilityPath, loaded: true,
   exports: {
-    spawnSubagent: async (prompt, opts) => { subagentCalls++; lastOpts = opts; return subagentResponder(prompt, opts); },
-    concurrentCount: () => 0,
+    spawnUtilityAgent: async (prompt, opts) => {
+      utilityCalls++;
+      lastOpts = opts;
+      return {
+        provider: "claude",
+        model: "claude-enforcer-fixture",
+        fallbackUsed: false,
+        ...await utilityResponder(prompt, opts),
+      };
+    },
   },
 };
 
@@ -77,24 +87,28 @@ const extSpeaker = relationship.speakerFor("telegram", CH_EXT);
   delete process.env.ENFORCER; // back to default-on for the rest
 
   // ── owner is a strict no-op: guardOutboundReply allows without vetting ──
-  subagentCalls = 0;
+  utilityCalls = 0;
   const ownerRes = await inChat(CH_OWNER, () => enforcer.guardOutboundReply("here are the k8s creds"));
   assert.deepStrictEqual(ownerRes, { allow: true, guarded: false }, "owner reply is never guarded");
-  assert.strictEqual(subagentCalls, 0, "owner path never calls the guard model");
+  assert.strictEqual(utilityCalls, 0, "owner path never calls the guard model");
 
   // ── external allow: guardOutboundReply vets and lets an in-scope reply through ──
-  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"invoicing is in scope"}' });
+  utilityResponder = async () => ({ text: '{"decision":"allow","reason":"invoicing is in scope"}' });
   const extAllow = await inChat(CH_EXT, () => enforcer.guardOutboundReply("Your invoice is fully paid."));
   assert.strictEqual(extAllow.allow, true, "in-scope external reply allowed");
   assert.strictEqual(extAllow.guarded, true, "external reply is guarded");
   assert.strictEqual(extAllow.decision, "allow", "decision surfaced");
-  // guard sub-agent is invoked read-only with the fixed system prompt.
-  assert.deepStrictEqual(lastOpts.allowedTools, [], "guard sub-agent gets no tools");
-  assert.strictEqual(lastOpts.permissionMode, "plan", "guard runs in plan mode (read-only)");
+  // The utility guard is schema-bounded and read-only without overstating
+  // provider-hosted tool suppression.
+  assert.strictEqual(lastOpts.purpose, "enforcer");
+  assert.strictEqual(lastOpts.tier, "medium");
+  assert.strictEqual(lastOpts.readOnly, true);
+  assert.ok(lastOpts.outputSchema, "guard requests a structured verdict");
+  assert.strictEqual(lastOpts.allowedTools, undefined, "guard does not claim unverified hosted-tool suppression");
   assert.strictEqual(lastOpts.systemPrompt, enforcer.GUARD_SYSTEM_PROMPT, "guard uses the fixed guard prompt");
 
   // ── external block → escalate: reply held, owner buttoned, external stalled ──
-  subagentResponder = async () => ({ text: '{"decision":"block","reason":"outside the invoicing mandate"}' });
+  utilityResponder = async () => ({ text: '{"decision":"block","reason":"outside the invoicing mandate"}' });
   sends.length = 0;
   const blocked = await inChat(CH_EXT, () => enforcer.guardOutboundReply("Here are the server credentials: root/hunter2."));
   assert.strictEqual(blocked.allow, false, "out-of-scope reply is NOT sent");
@@ -122,7 +136,22 @@ const extSpeaker = relationship.speakerFor("telegram", CH_EXT);
   assert.strictEqual(rr.personName, "Zephyr Contact", "person recorded for Always-allow");
 
   // ── escalate() record shape: destructive action ──
-  const escAct = await enforcer.escalate({ speaker: extSpeaker, kind: "action", command: "open-claudia tool run fleet restart n1", tier: "destructive", reason: "not in mandate" });
+  const escAct = await enforcer.escalate({
+    speaker: extSpeaker,
+    kind: "action",
+    command: "open-claudia tool run fleet restart n1",
+    tier: "destructive",
+    reason: "not in mandate",
+    canonicalUserId: "owner-canonical",
+    userId: "external-user",
+    provider: "codex",
+    providerSettings: { model: "gpt-fixture" },
+    project: "fixture-project",
+    projectDir: "/fixture/project",
+    sessionId: "fixture-session",
+    previousSessionId: "fixture-previous",
+    originRunId: "fixture-run",
+  });
   assert.strictEqual(escAct.escalated, true, "action escalation succeeds");
   const ar = approvals.read(escAct.id);
   assert.strictEqual(ar.tool, "external-action", "action → external-action tool");
@@ -130,41 +159,55 @@ const extSpeaker = relationship.speakerFor("telegram", CH_EXT);
   assert.strictEqual(ar.tier, "destructive", "action tier preserved");
   assert.ok(ar.command.includes("fleet restart n1"), "the exact command is stored");
   assert.strictEqual(ar.payloadText, "", "an action carries no reply payload");
+  assert.strictEqual(ar.provider, "codex", "external actions retain their originating provider");
+  assert.deepStrictEqual(ar.providerSettings, { model: "gpt-fixture" });
+  assert.strictEqual(ar.project, "fixture-project", "external actions retain the originating project");
+  assert.strictEqual(ar.canonicalUserId, "owner-canonical", "external action wakeups remain pinned to the canonical user");
+  assert.strictEqual(ar.originRunId, "fixture-run", "external action wakeups retain run lineage");
 
   // ── vetAction allow ──
-  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"listing is in scope"}' });
+  utilityResponder = async () => ({ text: '{"decision":"allow","reason":"listing is in scope"}' });
   const va = await enforcer.vetAction(extSpeaker, { command: "open-claudia tool run kticket list", tier: "write" });
   assert.strictEqual(va.decision, "allow", "in-scope action allowed");
 
   // ── cache: two identical vets → the model is called exactly once ──
-  subagentCalls = 0;
-  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
+  utilityCalls = 0;
+  utilityResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
   const CACHE_P = "identical-cache-payload-xyz";
   const c1 = await enforcer.vetReply(extSpeaker, CACHE_P);
   const c2 = await enforcer.vetReply(extSpeaker, CACHE_P);
   assert.strictEqual(c1.decision, "allow");
   assert.strictEqual(c2.decision, "allow");
-  assert.strictEqual(subagentCalls, 1, "identical vet is cached — the guard model runs once");
+  assert.strictEqual(utilityCalls, 1, "identical vet is cached — the guard model runs once");
 
   // ── fail CLOSED and NOT cached: a thrown model call → escalate, re-judged next time ──
-  subagentCalls = 0;
+  utilityCalls = 0;
   const FC_P = "fail-closed-payload-abc";
-  subagentResponder = async () => { throw new Error("model unreachable"); };
+  utilityResponder = async () => { throw new Error("model unreachable"); };
   const f1 = await enforcer.vetReply(extSpeaker, FC_P);
   assert.strictEqual(f1.decision, "escalate", "thrown model → escalate (fail closed)");
   assert.ok(/failing closed/.test(f1.reason), "fail-closed reason surfaced");
-  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"now reachable"}' });
+  utilityResponder = async () => ({ text: '{"decision":"allow","reason":"now reachable"}' });
   const f2 = await enforcer.vetReply(extSpeaker, FC_P);
   assert.strictEqual(f2.decision, "allow", "the failure was NOT cached — it is re-judged");
-  assert.strictEqual(subagentCalls, 2, "both attempts reached the model");
+  assert.strictEqual(utilityCalls, 2, "both attempts reached the model");
 
   // ── unparseable + invalid decision both fail closed to escalate ──
-  subagentResponder = async () => ({ text: "I'm sorry, I can't do that." });
+  utilityResponder = async () => ({ text: "I'm sorry, I can't do that." });
   const up = await enforcer.vetReply(extSpeaker, "no-json-payload-1");
   assert.strictEqual(up.decision, "escalate", "no JSON in the verdict → escalate");
-  subagentResponder = async () => ({ text: '{"decision":"maybe","reason":"unsure"}' });
+  utilityResponder = async () => ({ text: '{"decision":"maybe","reason":"unsure"}' });
   const iv = await enforcer.vetReply(extSpeaker, "bad-decision-payload-1");
-  assert.strictEqual(iv.decision, "escalate", "unknown decision value coerced to escalate");
+  assert.strictEqual(iv.decision, "escalate", "unknown decision value fails closed to escalate");
+
+  // Audit records only stable decision/provider metadata. Guard prompts,
+  // mandates, proposed replies, and model reasons stay out of the log.
+  const verdictAudit = require("./core/audit").tail(100).filter((entry) => entry.kind === "enforcer.verdict");
+  assert.ok(verdictAudit.some((entry) => entry.provider === "claude" && entry.model === "claude-enforcer-fixture"));
+  assert.ok(verdictAudit.some((entry) => entry.status === "failed" && entry.decision === "escalate"));
+  const auditRaw = fs.readFileSync(require("./core/config").AUDIT_FILE, "utf8");
+  assert.ok(!auditRaw.includes("hunter2"), "blocked reply content never enters the audit log");
+  assert.ok(!auditRaw.includes("May only discuss invoicing status"), "owner-authored mandate never enters the audit log");
 
   console.log("enforcer OK");
 })().catch((e) => { console.error(e); process.exit(1); });