@inetafrica/open-claudia 2.15.0 → 3.0.1

package/test-provider-boot-matrix.js

@@ -0,0 +1,399 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const http = require("http");
+const { spawnSync } = require("child_process");
+
+const root = __dirname;
+
+function writeProviderCli(filePath, kind, mode, logPath) {
+  const source = `#!/usr/bin/env node
+"use strict";
+const fs = require("fs");
+const args = process.argv.slice(2);
+fs.appendFileSync(${JSON.stringify(logPath)}, JSON.stringify({ kind: ${JSON.stringify(kind)}, args }) + "\\n");
+const same = (...wanted) => args.length === wanted.length && args.every((value, index) => value === wanted[index]);
+if (same("--version")) {
+  process.stdout.write(${JSON.stringify(kind === "claude" ? "1.2.3\n" : "codex-cli 0.144.0\n")});
+} else if (${JSON.stringify(kind)} === "claude" && same("--help")) {
+  process.stdout.write(${JSON.stringify(mode === "incompatible"
+    ? "--output-format --resume --permission-mode --settings\n"
+    : "--append-system-prompt --output-format --resume --permission-mode --settings\n")});
+} else if (${JSON.stringify(kind)} === "claude" && same("auth", "status")) {
+  if (${JSON.stringify(mode)} === "unauthenticated") {
+    process.stderr.write("not logged in\\n");
+    process.exitCode = 1;
+  } else process.stdout.write("authenticated via fixture store\\n");
+} else if (${JSON.stringify(kind)} === "codex" && (same("exec", "--help") || same("exec", "resume", "--help"))) {
+  process.stdout.write(${JSON.stringify(mode === "incompatible"
+    ? "--config --json --sandbox --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n"
+    : "--config --json --sandbox --image --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n")});
+} else if (${JSON.stringify(kind)} === "codex" && args[0] === "features" && args.at(-1) === "list") {
+  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable false\\n");
+} else if (${JSON.stringify(kind)} === "codex" && same("login", "status")) {
+  if (${JSON.stringify(mode)} === "unauthenticated") {
+    process.stderr.write("not logged in\\n");
+    process.exitCode = 1;
+  } else process.stdout.write("logged in\\n");
+} else {
+  process.stderr.write("MODEL_PROMPT_INVOCATION " + JSON.stringify(args) + "\\n");
+  process.exitCode = 70;
+}
+`;
+  fs.writeFileSync(filePath, source, { mode: 0o755 });
+}
+
+function readCommandLog(logPath) {
+  if (!fs.existsSync(logPath)) return [];
+  return fs.readFileSync(logPath, "utf8")
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => JSON.parse(line));
+}
+
+function isLocalStatusProbe(entry) {
+  const joined = entry.args.join(" ");
+  if (entry.kind === "claude") {
+    return joined === "--version" || joined === "--help" || joined === "auth status";
+  }
+  return joined === "--version"
+    || joined === "exec --help"
+    || joined === "exec resume --help"
+    || joined === "login status"
+    || (entry.args[0] === "features" && entry.args.at(-1) === "list");
+}
+
+async function childProbe() {
+  const config = require("./core/config");
+  const providers = require("./core/providers");
+  const setup = require("./setup");
+  const health = require("./health");
+  const doctor = require("./core/doctor");
+  const web = require("./web");
+  const stateApi = require("./core/state");
+  const { captureRunContext } = require("./core/run-context");
+
+  const selection = providers.selectDefaultProvider(config.DEFAULT_PROVIDER);
+  const freshState = stateApi.currentState();
+  const stateProvider = stateApi.getActiveProvider(freshState);
+  const setupStatus = setup.inspectProviderSetup();
+  const healthStatus = await health.runHealthChecks({ quick: false, skipNetwork: true });
+  const doctorChecks = doctor.runDoctorChecks();
+  const webStatus = web.providerConfigurationStatus();
+
+  // Startup, not merely import, must remain available without a provider.
+  const server = web.startWebServer();
+  if (!server.listening) await new Promise((resolve) => server.once("listening", resolve));
+  await new Promise((resolve) => server.close(resolve));
+
+  let afterDisappear = null;
+  if (process.env.DISAPPEAR_PROVIDER) {
+    const providerId = process.env.DISAPPEAR_PROVIDER;
+    const executable = config.discoverProviderExecutable(providerId);
+    if (executable) fs.rmSync(executable, { force: true });
+    afterDisappear = {
+      status: providers.providerStatus(providerId),
+      selection: providers.selectDefaultProvider(config.DEFAULT_PROVIDER),
+    };
+    try {
+      providers.resolveProviderForRun(providerId);
+    } catch (error) {
+      afterDisappear.runError = error.code;
+    }
+  }
+
+  let noProviderTurn = null;
+  if (!selection.providerId) {
+    let admissionError;
+    try {
+      captureRunContext({ state: freshState, prompt: "must not spawn", cwd: process.cwd() });
+    } catch (error) {
+      admissionError = error;
+    }
+    const sent = [];
+    const { runInChat } = require("./core/context");
+    const { deliverRouterError } = require("./core/router");
+    const delivered = await runInChat({
+      adapter: { type: "fixture", send: async (_channelId, message) => { sent.push(message); return true; } },
+      channelId: "fixture-chat",
+      canonicalUserId: "telegram:fixture-chat",
+      userId: "fixture-chat",
+    }, () => deliverRouterError(admissionError));
+    noProviderTurn = { admissionCode: admissionError?.code || null, delivered, sent };
+  }
+
+  process.stdout.write(`BOOT_MATRIX:${JSON.stringify({
+    selection,
+    stateProvider,
+    setupStatus,
+    healthStatus,
+    doctorChecks,
+    webStatus,
+    afterDisappear,
+    noProviderTurn,
+  })}\n`);
+}
+
+function httpRequest(port, pathname, options = {}) {
+  return new Promise((resolve, reject) => {
+    const body = options.body === undefined ? null : JSON.stringify(options.body);
+    const req = http.request({
+      hostname: "127.0.0.1",
+      port,
+      path: pathname,
+      method: options.method || "GET",
+      headers: {
+        ...(body ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) } : {}),
+        ...(options.cookie ? { Cookie: options.cookie } : {}),
+      },
+    }, (res) => {
+      let data = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => { data += chunk; });
+      res.on("end", () => resolve({
+        status: res.statusCode,
+        headers: res.headers,
+        body: data ? JSON.parse(data) : null,
+      }));
+    });
+    req.on("error", reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+async function webHttpProbe() {
+  const web = require("./web");
+  const server = web.startWebServer({
+    telegramGet: async () => ({ ok: true, result: { id: 1, username: "fixture_bot", first_name: "Fixture" } }),
+  });
+  if (!server.listening) await new Promise((resolve) => server.once("listening", resolve));
+  const port = server.address().port;
+  const login = await httpRequest(port, "/api/login", {
+    method: "POST",
+    body: { password: process.env.WEB_PASSWORD },
+  });
+  assert.strictEqual(login.status, 200);
+  const cookie = String(login.headers["set-cookie"][0]).split(";")[0];
+  const setup = await httpRequest(port, "/api/setup", {
+    method: "POST",
+    cookie,
+    body: {
+      botToken: "fixture-token",
+      chatId: "fixture-chat",
+      workspace: process.env.WEB_FIXTURE_WORKSPACE,
+      claudePath: "",
+      codexPath: process.env.WEB_FIXTURE_CODEX,
+      defaultProvider: "codex",
+      utilityProvider: "active",
+      providerFallbacks: "claude",
+    },
+  });
+  assert.strictEqual(setup.status, 200, JSON.stringify(setup.body));
+  const status = await httpRequest(port, "/api/status", { cookie });
+  const configUpdate = await httpRequest(port, "/api/config", {
+    method: "POST",
+    cookie,
+    body: { UTILITY_PROVIDER: "codex", DREAM_PROVIDER: "codex" },
+  });
+  const config = await httpRequest(port, "/api/config", { cookie });
+  const soulUpdate = await httpRequest(port, "/api/soul", {
+    method: "POST",
+    cookie,
+    body: { content: "# Soul\n\nProvider-neutral fixture soul.\n" },
+  });
+  const soul = await httpRequest(port, "/api/soul", { cookie });
+  await new Promise((resolve) => server.close(resolve));
+  const envPath = path.join(process.env.OPEN_CLAUDIA_CONFIG_DIR, ".env");
+  process.stdout.write(`WEB_HTTP:${JSON.stringify({
+    setup: setup.body,
+    status: status.body,
+    configUpdate: configUpdate.body,
+    config: config.body,
+    soulUpdate: soulUpdate.body,
+    soul: soul.body,
+    envMode: fs.statSync(envPath).mode & 0o777,
+  })}\n`);
+}
+
+if (process.argv[2] === "--probe") {
+  childProbe().catch((error) => {
+    process.stderr.write(`${error.stack || error.message}\n`);
+    process.exitCode = 1;
+  });
+} else if (process.argv[2] === "--web-http-probe") {
+  webHttpProbe().catch((error) => {
+    process.stderr.write(`${error.stack || error.message}\n`);
+    process.exitCode = 1;
+  });
+} else {
+  const scenarios = [
+    { name: "claude-only", providers: { claude: "ok" }, expectedDefault: "claude" },
+    { name: "codex-only", providers: { codex: "ok" }, expectedDefault: "codex" },
+    { name: "codex-path-only", providers: { codex: "ok" }, pathOnly: true, expectedDefault: "codex" },
+    { name: "dual", providers: { claude: "ok", codex: "ok" }, expectedDefault: "claude" },
+    { name: "explicit-codex", providers: { claude: "ok", codex: "ok" }, defaultProvider: "codex", expectedDefault: "codex" },
+    { name: "neither", providers: {}, expectedDefault: null },
+    { name: "missing-executable", providers: { claude: "missing" }, expectedDefault: null },
+    { name: "incompatible", providers: { claude: "incompatible" }, expectedDefault: null },
+    { name: "unauthenticated", providers: { codex: "unauthenticated" }, expectedDefault: "codex", expectedAuth: "unauthenticated" },
+    { name: "disappearing", providers: { claude: "ok" }, expectedDefault: "claude", disappear: "claude" },
+  ];
+
+  const setupApi = require("./setup");
+  const resumed = setupApi.upgradeSetupState({
+    completedSteps: ["prerequisites", "telegram"],
+    data: { claudePath: "/legacy/claude" },
+  });
+  assert.ok(!resumed.completedSteps.includes("prerequisites"), "legacy setup state must revisit provider discovery");
+  assert.ok(resumed.completedSteps.includes("telegram"), "unrelated completed setup steps are preserved");
+
+  for (const scenario of scenarios) {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), `open-claudia-boot-${scenario.name}-`));
+    const home = path.join(temp, "home");
+    const configDir = path.join(temp, "config");
+    const workspace = path.join(temp, "workspace");
+    const binDir = path.join(temp, "bin");
+    const commandLog = path.join(temp, "provider-commands.jsonl");
+    fs.mkdirSync(home);
+    fs.mkdirSync(configDir);
+    fs.mkdirSync(workspace);
+    fs.mkdirSync(binDir);
+
+    const envLines = [
+      "CHANNELS=",
+      "TELEGRAM_BOT_TOKEN=fixture-token",
+      "TELEGRAM_CHAT_ID=fixture-chat",
+      `WORKSPACE=${workspace}`,
+    ];
+    for (const providerId of ["claude", "codex"]) {
+      const mode = scenario.providers[providerId];
+      if (!mode) continue;
+      const envKey = providerId === "claude" ? "CLAUDE_PATH" : "CODEX_PATH";
+      if (mode === "missing") {
+        envLines.push(`${envKey}=${path.join(binDir, `${providerId}-missing`)}`);
+        continue;
+      }
+      const executable = path.join(binDir, providerId);
+      writeProviderCli(executable, providerId, mode, commandLog);
+      if (!scenario.pathOnly) envLines.push(`${envKey}=${executable}`);
+    }
+    if (scenario.defaultProvider) envLines.push(`DEFAULT_PROVIDER=${scenario.defaultProvider}`);
+    fs.writeFileSync(path.join(configDir, ".env"), `${envLines.join("\n")}\n`);
+
+    const child = spawnSync(process.execPath, [__filename, "--probe"], {
+      cwd: root,
+      env: {
+        HOME: home,
+        PATH: [binDir, path.dirname(process.execPath), "/usr/bin", "/bin"].join(path.delimiter),
+        OPEN_CLAUDIA_CONFIG_DIR: configDir,
+        OPEN_CLAUDIA_TEST: "1",
+        WEB_PORT: "0",
+        DISAPPEAR_PROVIDER: scenario.disappear || "",
+      },
+      encoding: "utf8",
+      timeout: 30000,
+    });
+
+    try {
+      assert.ifError(child.error);
+      assert.strictEqual(child.status, 0, child.stderr || child.stdout);
+      const marker = child.stdout.split(/\r?\n/).find((line) => line.startsWith("BOOT_MATRIX:"));
+      assert.ok(marker, `${scenario.name}: missing boot-matrix output`);
+      const output = JSON.parse(marker.slice("BOOT_MATRIX:".length));
+      assert.strictEqual(output.selection.providerId, scenario.expectedDefault, `${scenario.name}: deterministic default`);
+      assert.strictEqual(output.stateProvider, scenario.expectedDefault, `${scenario.name}: fresh state adopts the default`);
+      assert.strictEqual(output.setupStatus.defaultProvider.providerId, scenario.expectedDefault, `${scenario.name}: terminal setup default`);
+      assert.strictEqual(output.webStatus.defaultProvider.providerId, scenario.expectedDefault, `${scenario.name}: web default`);
+      assert.strictEqual(output.healthStatus.providerSummary.defaultProvider.providerId, scenario.expectedDefault, `${scenario.name}: health default`);
+
+      for (const providerId of ["claude", "codex"]) {
+        const expectedMode = scenario.providers[providerId];
+        const setupProvider = output.setupStatus.providers.find((entry) => entry.id === providerId);
+        const webProvider = output.webStatus.providers.find((entry) => entry.id === providerId);
+        assert.ok(setupProvider && webProvider, `${scenario.name}: ${providerId} must be enumerated`);
+        assert.strictEqual(webProvider.availability.state, setupProvider.availability.state);
+        if (expectedMode === "missing") assert.strictEqual(setupProvider.availability.state, "missing");
+        else if (!expectedMode) assert.strictEqual(setupProvider.availability.state, "unconfigured");
+        else assert.strictEqual(setupProvider.availability.state, "available");
+        if (expectedMode === "incompatible") assert.strictEqual(setupProvider.compatibility.state, "incompatible");
+        if (providerId === scenario.expectedDefault && scenario.expectedAuth) {
+          assert.strictEqual(setupProvider.auth.state, scenario.expectedAuth);
+        }
+      }
+
+      const doctorLabels = output.doctorChecks.map((check) => check.label);
+      assert.ok(doctorLabels.includes("Claude Code availability"), `${scenario.name}: doctor enumerates Claude`);
+      assert.ok(doctorLabels.includes("OpenAI Codex availability"), `${scenario.name}: doctor enumerates Codex`);
+      assert.ok(doctorLabels.includes("Default provider"), `${scenario.name}: doctor reports the default choice`);
+
+      if (scenario.disappear) {
+        assert.strictEqual(output.afterDisappear.status.availability.state, "missing");
+        assert.strictEqual(output.afterDisappear.selection.providerId, null);
+        assert.strictEqual(output.afterDisappear.runError, "PROVIDER_UNAVAILABLE");
+      }
+      if (!scenario.expectedDefault) {
+        assert.strictEqual(output.noProviderTurn.admissionCode, "NO_AVAILABLE_PROVIDER");
+        assert.strictEqual(output.noProviderTurn.delivered.error.code, "NO_AVAILABLE_PROVIDER");
+        assert.strictEqual(output.noProviderTurn.sent.length, 1, `${scenario.name}: no-provider error is user-visible`);
+      }
+
+      const commands = readCommandLog(commandLog);
+      assert.ok(commands.every(isLocalStatusProbe), `${scenario.name}: health/setup invoked a model prompt: ${JSON.stringify(commands)}`);
+    } finally {
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  }
+
+  const webTemp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-web-boot-"));
+  try {
+    const configDir = path.join(webTemp, "new-config");
+    const home = path.join(webTemp, "home");
+    const binDir = path.join(webTemp, "bin");
+    const workspace = path.join(webTemp, "workspace");
+    const commandLog = path.join(webTemp, "provider-commands.jsonl");
+    fs.mkdirSync(home);
+    fs.mkdirSync(binDir);
+    const codexPath = path.join(binDir, "codex");
+    writeProviderCli(codexPath, "codex", "ok", commandLog);
+    const webChild = spawnSync(process.execPath, [__filename, "--web-http-probe"], {
+      cwd: root,
+      env: {
+        HOME: home,
+        PATH: [binDir, path.dirname(process.execPath), "/usr/bin", "/bin"].join(path.delimiter),
+        OPEN_CLAUDIA_CONFIG_DIR: configDir,
+        OPEN_CLAUDIA_TEST: "1",
+        WEB_PORT: "0",
+        WEB_PASSWORD: "FixturePass1!",
+        WEB_FIXTURE_CODEX: codexPath,
+        WEB_FIXTURE_WORKSPACE: workspace,
+      },
+      encoding: "utf8",
+      timeout: 30000,
+    });
+    assert.ifError(webChild.error);
+    assert.strictEqual(webChild.status, 0, webChild.stderr || webChild.stdout);
+    const marker = webChild.stdout.split(/\r?\n/).find((line) => line.startsWith("WEB_HTTP:"));
+    assert.ok(marker, "fresh web startup must complete HTTP setup probe");
+    const output = JSON.parse(marker.slice("WEB_HTTP:".length));
+    assert.strictEqual(output.setup.ok, true);
+    assert.strictEqual(output.status.defaultProvider.providerId, "codex", "web setup refreshes cached default status");
+    assert.strictEqual(output.status.providers.find((provider) => provider.id === "codex").availability.state, "available");
+    assert.strictEqual(output.configUpdate.ok, true, "web config POST is reachable");
+    assert.strictEqual(output.config.UTILITY_PROVIDER, "codex");
+    assert.strictEqual(output.config.DREAM_PROVIDER, "codex");
+    assert.strictEqual(output.soulUpdate.ok, true, "web soul POST is reachable");
+    assert.match(output.soul.content, /Provider-neutral fixture soul/);
+    assert.strictEqual(output.envMode, 0o600, "web config is private");
+    assert.ok(readCommandLog(commandLog).every(isLocalStatusProbe), "web setup/status must not invoke a model prompt");
+  } finally {
+    fs.rmSync(webTemp, { recursive: true, force: true });
+  }
+
+  console.log("provider boot matrix OK");
+}

package/test-provider-bootstrap.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+function statusProvider(id, overrides = {}) {
+  const { CAPABILITY_KEYS } = require("./core/providers/contract");
+  const capabilities = Object.fromEntries(CAPABILITY_KEYS.map((key) => [key, {
+    support: "unsupported",
+    reason: "fixture capability",
+    ...(key === "effort" ? { values: [] } : {}),
+  }]));
+  return {
+    id,
+    label: id === "claude" ? "Claude Code" : "OpenAI Codex",
+    isAvailable: () => true,
+    executable: () => `/fixture/${id}`,
+    defaultModel: () => null,
+    tierModel: (tier) => `${id}-${tier}`,
+    modelChoices: () => [],
+    compatibilityStatus: () => overrides.compatibility || { state: "compatible", version: "1.0.0", reason: null },
+    capabilities,
+    buildMainInvocation: () => ({ binary: `/fixture/${id}`, args: [], env: {}, stdin: null, parserState: {} }),
+    buildUtilityInvocation: () => ({ binary: `/fixture/${id}`, args: [], env: {}, stdin: null, parserState: {} }),
+    createEventDecoder: () => ({ push: () => [], end: () => [] }),
+    normalizeEvent: () => [],
+    authStatus: () => overrides.auth || { state: "authenticated", reason: null },
+    authHelp: () => "fixture auth help",
+  };
+}
+
+function childProbe() {
+  const configDirApi = require("./core/config-dir");
+  const config = require("./core/config");
+
+  // Setup and status helpers must be importable without starting setup,
+  // writing state, probing a provider, or exiting the process.
+  require("./setup");
+  require("./health");
+  require("./core/doctor");
+
+  const result = {
+    configDir: config.CONFIG_DIR,
+    resolvedConfigDir: configDirApi.resolveConfigDir(process.env),
+    workspace: config.WORKSPACE,
+    claudeConfigured: config.configuredProviderPath("claude"),
+    codexConfigured: config.configuredProviderPath("codex"),
+    claudeAvailability: config.providerExecutableStatus("claude"),
+    codexAvailability: config.providerExecutableStatus("codex"),
+  };
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+if (process.argv[2] === "--probe") {
+  childProbe();
+} else {
+  const { resolveConfigDir } = require("./core/config-dir");
+  assert.strictEqual(
+    resolveConfigDir({ HOME: "/fixture/home", OPEN_CLAUDIA_CONFIG_DIR: "/fixture/config" }),
+    path.resolve("/fixture/config"),
+  );
+  assert.strictEqual(
+    resolveConfigDir({ HOME: "/fixture/home" }),
+    path.resolve("/fixture/home/.open-claudia"),
+  );
+
+  const cases = [
+    { name: "claude-only", claude: "present", codex: null, expected: ["available", "unconfigured"] },
+    { name: "codex-only", claude: null, codex: "present", expected: ["unconfigured", "available"] },
+    { name: "both", claude: "present", codex: "present", expected: ["available", "available"] },
+    { name: "neither", claude: null, codex: null, expected: ["unconfigured", "unconfigured"] },
+    { name: "missing-claude", claude: "missing", codex: null, expected: ["missing", "unconfigured"] },
+    { name: "missing-codex", claude: null, codex: "missing", expected: ["unconfigured", "missing"] },
+    { name: "path-only-claude", claude: "path-only", codex: null, expected: ["available", "unconfigured"] },
+    { name: "path-only-codex", claude: null, codex: "path-only", expected: ["unconfigured", "available"] },
+  ];
+
+  for (const testCase of cases) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `open-claudia-bootstrap-${testCase.name}-`));
+    const home = path.join(root, "home");
+    const configDir = path.join(root, "config");
+    const workspace = path.join(root, "workspace");
+    const binDir = path.join(root, "bin");
+    fs.mkdirSync(home);
+    fs.mkdirSync(binDir);
+
+    const configuredPath = (providerName, disposition) => {
+      if (!disposition) return undefined;
+      if (disposition === "missing") return path.join(binDir, `${providerName}-missing`);
+      const target = path.join(binDir, providerName);
+      fs.symlinkSync(process.execPath, target);
+      return disposition === "path-only" ? undefined : target;
+    };
+
+    const env = {
+      HOME: home,
+      PATH: binDir,
+      OPEN_CLAUDIA_CONFIG_DIR: configDir,
+      WORKSPACE: workspace,
+      CHANNELS: "",
+      OPEN_CLAUDIA_TEST: "1",
+      CLAUDE_PATH: configuredPath("claude", testCase.claude),
+      CODEX_PATH: configuredPath("codex", testCase.codex),
+    };
+    for (const key of Object.keys(env)) {
+      if (env[key] === undefined) delete env[key];
+    }
+
+    try {
+      const child = spawnSync(process.execPath, [__filename, "--probe"], {
+        cwd: __dirname,
+        env,
+        encoding: "utf8",
+        timeout: 10000,
+      });
+      assert.ifError(child.error);
+      assert.strictEqual(child.status, 0, child.stderr || `${testCase.name} import probe failed`);
+      const output = JSON.parse(child.stdout.trim());
+      assert.strictEqual(output.configDir, path.resolve(configDir));
+      assert.strictEqual(output.resolvedConfigDir, path.resolve(configDir));
+      assert.strictEqual(output.workspace, workspace);
+      assert.deepStrictEqual(
+        [output.claudeAvailability.state, output.codexAvailability.state],
+        testCase.expected,
+      );
+      assert.ok(!fs.existsSync(configDir), `${testCase.name} imports must not create the config directory`);
+      assert.ok(!fs.existsSync(workspace), `${testCase.name} imports must not create the workspace`);
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  }
+
+  // Compatibility and auth are provider-owned typed states. They are kept
+  // separate so setup/status can explain an old CLI versus a logged-out CLI.
+  const { ProviderRegistry } = require("./core/providers");
+  const oldCli = new ProviderRegistry();
+  oldCli.registerProvider(statusProvider("claude", {
+    compatibility: { state: "incompatible", version: "0.0.1", reason: "too old" },
+  }));
+  assert.strictEqual(oldCli.providerStatus("claude").compatibility.state, "incompatible");
+
+  const loggedOut = new ProviderRegistry();
+  loggedOut.registerProvider(statusProvider("codex", {
+    auth: { state: "unauthenticated", reason: "login required" },
+  }));
+  assert.strictEqual(loggedOut.providerStatus("codex").auth.state, "unauthenticated");
+
+  const cliSource = fs.readFileSync(path.join(__dirname, "bin", "cli.js"), "utf8");
+  assert.match(cliSource, /case "setup":[\s\S]*setup\.js"\)\)\.main\(\)/, "CLI setup command must call the guarded setup entrypoint");
+  assert.match(cliSource, /Legacy:[\s\S]*setup\.js"\)\)\.main\(\)/, "legacy auth command must call the guarded setup entrypoint");
+
+  console.log("provider bootstrap OK");
+}