@kuznai/inception-engine 0.23.0 → 0.24.0

package/dist/test/unit/deploy.test.js

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { chmod, copyFile, lstat, mkdir, readdir, readFile, readlink, rename, rm, symlink, writeFile, } from "node:fs/promises";
+import { copyFile, mkdir, readdir, readFile, rename, rm, symlink, writeFile, } from "node:fs/promises";
 import path from "node:path";
 import { describe, it } from "node:test";
 import { executeDeploy, planDeploy } from "../../src/core/deploy.js";
@@ -587,13 +587,13 @@ describe("planDeploy", () => {
                 {
                     name: "codex-file",
                     path: "missing.txt",
-                    target: "{home}/missing.txt",
+                    target: "{home}/.codex/AGENTS.md",
                     agents: ["codex"],
                 },
                 {
                     name: "claude-file",
                     path: "present.txt",
-                    target: "{home}/present.txt",
+                    target: "{home}/.claude/CLAUDE.md",
                     agents: ["claude-code"],
                 },
             ],
@@ -613,6 +613,65 @@ describe("planDeploy", () => {
             await rm(sourceDir, { recursive: true });
         }
     });
+    it("rejects generic home-scoped file targets outside approved agent surfaces", async () => {
+        const sourceDir = await makeTmpDir();
+        const manifest = {
+            skills: [],
+            files: [
+                {
+                    name: "unsafe-file",
+                    path: "present.txt",
+                    target: "{home}/.ssh/config",
+                    agents: ["claude-code"],
+                },
+            ],
+            configs: [],
+            mcpServers: [],
+            agentRules: [],
+            permissions: [],
+            agentDefinitions: [],
+        };
+        try {
+            await writeFile(path.join(sourceDir, "present.txt"), "present");
+            await assert.rejects(planDeploy(manifest, sourceDir, ["claude-code"], "/home/test"), (err) => {
+                assert.ok(err instanceof UserError);
+                assert.equal(err.code, "DEPLOY_FAILED");
+                assert.match(err.message, /not an approved managed surface/);
+                return true;
+            });
+        }
+        finally {
+            await rm(sourceDir, { recursive: true });
+        }
+    });
+    it("allows generic repo-scoped file targets", async () => {
+        const sourceDir = await makeTmpDir();
+        const manifest = {
+            skills: [],
+            files: [
+                {
+                    name: "repo-file",
+                    path: "present.txt",
+                    target: "{repo}/.agents/rules/example.md",
+                    agents: ["claude-code"],
+                },
+            ],
+            configs: [],
+            mcpServers: [],
+            agentRules: [],
+            permissions: [],
+            agentDefinitions: [],
+        };
+        try {
+            await writeFile(path.join(sourceDir, "present.txt"), "present");
+            const { actions } = await planDeploy(manifest, sourceDir, ["claude-code"], "/home/test");
+            assert.equal(actions.length, 1);
+            assertPathEndsWith(actions[0]?.target ?? "", path.join(".agents", "rules", "example.md"));
+        }
+        finally {
+            await rm(sourceDir, { recursive: true });
+        }
+    });
     it("ignores invalid agentRule sources for agents that are not being deployed", async () => {
         const sourceDir = await makeTmpDir();
         const manifest = {
@@ -897,418 +956,6 @@ describe("planDeploy", () => {
         }
     });
 });
-describe("executeDeploy", { skip: process.platform === "win32" }, () => {
-    it("creates symlinks on POSIX", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            const target = actions[0]?.target;
-            assert.ok(await exists(target));
-            assert.ok((await lstat(target)).isSymbolicLink());
-            const action = actions[0];
-            if (action?.kind !== "skill-dir") {
-                assert.fail("Expected skill-dir action");
-            }
-            assert.equal(await readlink(target), action.source);
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("registers deployment in registry on POSIX symlink deploy", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            const skillSource = await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            await executeDeploy(actions, false, false, home);
-            const target = actions[0]?.target;
-            // Registry should have the entry
-            const entry = await lookupDeployment(home, target);
-            assert.ok(entry);
-            if (entry.kind !== "skill-dir")
-                assert.fail("Expected skill-dir");
-            assert.equal(entry.skill, "test-skill");
-            assert.equal(entry.agent, "claude-code");
-            assert.equal(entry.source, skillSource);
-            assert.equal(entry.method, "symlink");
-            // No .inception-totem should exist in source
-            assert.ok(!(await exists(path.join(skillSource, ".inception-totem"))), "no .inception-totem should be written to source directory");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("does not create symlinks in dry-run mode", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const { succeeded, failed } = await executeDeploy(actions, true, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            const target = actions[0]?.target;
-            assert.ok(!(await exists(target)));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("overwrites existing symlink (with registry entry)", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            // Deploy twice - second should overwrite (first creates registry entry)
-            await executeDeploy(actions, false, false, home);
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("reports error for missing source (caught at planning)", async () => {
-        const home = await makeTmpDir();
-        try {
-            await assert.rejects(planDeploy(testManifest, "/nonexistent/source", ["claude-code"], home), (err) => {
-                assert.ok(err instanceof UserError);
-                assert.equal(err.code, "DEPLOY_FAILED");
-                assert.match(err.message, /source not found/);
-                return true;
-            });
-        }
-        finally {
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("reports permission denied when source is unreadable (caught at planning)", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        // Chmod the parent so traversal into the skill source dir fails with EACCES
-        const skillsDir = path.join(sourceDir, "skills");
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            await chmod(skillsDir, 0o000);
-            await assert.rejects(planDeploy(testManifest, sourceDir, ["claude-code"], home), (err) => {
-                assert.ok(err instanceof UserError);
-                assert.equal(err.code, "DEPLOY_FAILED");
-                assert.match(err.message, /Permission denied/);
-                return true;
-            });
-        }
-        finally {
-            await chmod(skillsDir, 0o755);
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("reports permission denied when skill directory is not readable (execute-only)", {
-        skip: process.platform === "win32" || process.getuid?.() === 0,
-    }, async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        const skillDir = path.join(sourceDir, "skills", "test-skill");
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            // 0o111 = --x--x--x: directory exists and is traversable but not readable
-            await chmod(skillDir, 0o111);
-            await assert.rejects(planDeploy(testManifest, sourceDir, ["claude-code"], home), (err) => {
-                assert.ok(err instanceof UserError);
-                assert.equal(err.code, "DEPLOY_FAILED");
-                assert.match(err.message, /Permission denied reading skill directory/);
-                return true;
-            });
-        }
-        finally {
-            try {
-                await chmod(skillDir, 0o755);
-            }
-            catch {
-                /* best effort */
-            }
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("reports permission denied when SKILL.md is not readable", {
-        skip: process.platform === "win32" || process.getuid?.() === 0,
-    }, async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        const skillMdPath = path.join(sourceDir, "skills", "test-skill", "SKILL.md");
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            await chmod(skillMdPath, 0o000);
-            await assert.rejects(planDeploy(testManifest, sourceDir, ["claude-code"], home), (err) => {
-                assert.ok(err instanceof UserError);
-                assert.equal(err.code, "DEPLOY_FAILED");
-                assert.match(err.message, /Permission denied reading SKILL\.md/);
-                return true;
-            });
-        }
-        finally {
-            try {
-                await chmod(skillMdPath, 0o644);
-            }
-            catch {
-                /* best effort */
-            }
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("refuses to overwrite unmanaged target", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            // Create an unmanaged directory at the target (no registry entry)
-            await mkdir(target, { recursive: true });
-            await writeFile(path.join(target, "something.txt"), "user content");
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            assert.ok(failed[0]?.error.includes("not managed by inception-engine"));
-            // Original content should still be there
-            assert.ok(await exists(path.join(target, "something.txt")));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("refuses to overwrite target with mismatched registry entry", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            // Create a directory at the target and register it under a different source/skill
-            await mkdir(target, { recursive: true });
-            await writeFile(path.join(target, "SKILL.md"), "other content");
-            await registerDeployment(home, target, {
-                kind: "skill-dir",
-                source: "/completely/different/source",
-                skill: "different-skill",
-                agent: "codex",
-                method: "symlink",
-            });
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            assert.ok(failed[0]?.error.includes("not managed by inception-engine"));
-            // Original content should still be there
-            assert.ok(await exists(path.join(target, "SKILL.md")));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("backup is removed after successful redeploy", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            await executeDeploy(actions, false, false, home);
-            await executeDeploy(actions, false, false, home);
-            assert.ok(!(await exists(backupPath)), "backup should not exist after successful redeploy");
-            assert.ok(await exists(target), "target should exist after redeploy");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-});
-describe("atomic redeploy behavior", {
-    skip: process.platform === "win32",
-}, () => {
-    it("cleans up stale .inception-backup from a previous failed attempt", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            // First deploy to establish managed target
-            await executeDeploy(actions, false, false, home);
-            // Simulate a stale backup left by a previous crash
-            await mkdir(backupPath, { recursive: true });
-            await writeFile(path.join(backupPath, "stale.txt"), "leftover");
-            // Redeploy should clean up the stale backup and succeed
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            assert.ok(!(await exists(backupPath)), "stale backup should be cleaned up");
-            assert.ok(await exists(target), "target should exist after redeploy");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("no backup is created on first deploy (no prior target)", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            const { succeeded } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.ok(await exists(target));
-            assert.ok(!(await exists(backupPath)), "no backup should be created when there was no prior target");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("restores backup when registry write fails (registry file read-only)", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        const registryFile = path.join(home, ".inception-engine", "registry.json");
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            // First deploy: establishes managed symlink and registry entry
-            const { succeeded: firstSucceeded } = await executeDeploy(actions, false, false, home);
-            assert.equal(firstSucceeded, 1);
-            const originalLink = await readlink(target);
-            // Make registry file read-only so registerDeployment fails on the next attempt.
-            // The lookupDeployment (read) still works; only the write will throw EACCES.
-            await chmod(registryFile, 0o444);
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            // Deploy must report failure
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            // Backup must be cleaned up (restored back to target)
-            assert.ok(!(await exists(backupPath)), "backup should be gone after rollback");
-            // Original managed symlink must be restored at the target path
-            assert.ok(await exists(target), "original symlink must be restored");
-            assert.ok((await lstat(target)).isSymbolicLink(), "restored target must be a symlink");
-            assert.equal(await readlink(target), originalLink, "restored symlink must point to original source");
-        }
-        finally {
-            try {
-                await chmod(registryFile, 0o644);
-            }
-            catch {
-                /* best effort */
-            }
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("restores backup when cp fails (source not readable)", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            // First deploy using copy method to establish a managed target directory
-            const skillSource = await createSkillSource(sourceDir, "skills/test-skill");
-            const target = path.join(home, ".claude", "skills", "test-skill");
-            await mkdir(path.dirname(target), { recursive: true });
-            const firstAction = {
-                kind: "skill-dir",
-                skill: "test-skill",
-                agent: "claude-code",
-                source: skillSource,
-                target,
-                method: "copy",
-                confidence: "documented",
-            };
-            const { succeeded: firstSucceeded } = await executeDeploy([firstAction], false, false, home);
-            assert.equal(firstSucceeded, 1);
-            assert.ok(await exists(target));
-            // Create an unreadable source directory for the next deploy attempt
-            // access() (F_OK) passes — the dir exists — but cp() fails reading its contents
-            const unreadableSource = path.join(sourceDir, "unreadable-source");
-            await mkdir(unreadableSource, { recursive: true });
-            await writeFile(path.join(unreadableSource, "SKILL.md"), "---");
-            await chmod(unreadableSource, 0o000);
-            const backupPath = `${target}.inception-backup`;
-            const failAction = {
-                kind: "skill-dir",
-                skill: "test-skill",
-                agent: "claude-code",
-                source: unreadableSource,
-                target,
-                method: "copy",
-                confidence: "documented",
-            };
-            const { succeeded, failed } = await executeDeploy([failAction], false, false, home);
-            // Deploy must report failure
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            // Backup must be cleaned up (restored back to target)
-            assert.ok(!(await exists(backupPath)), "backup should be gone after rollback");
-            // Original managed directory must be restored with its content intact
-            assert.ok(await exists(target), "original target must be restored");
-            assert.ok(await exists(path.join(target, "SKILL.md")), "restored target must have original content");
-        }
-        finally {
-            try {
-                await chmod(path.join(sourceDir, "unreadable-source"), 0o755);
-            }
-            catch {
-                /* best effort */
-            }
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("rename atomically replaces stale .inception-backup — no stale content leaks into target", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            // First deploy to establish a managed target
-            await executeDeploy(actions, false, false, home);
-            // Simulate a stale backup containing sentinel content
-            await mkdir(backupPath, { recursive: true });
-            await writeFile(path.join(backupPath, "stale.txt"), "leftover content");
-            // Redeploy: rename(target, backupPath) atomically replaces the stale dir
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            assert.ok(await exists(target), "target must exist after redeploy");
-            assert.ok(!(await exists(backupPath)), "stale backup must be cleaned up");
-            // The stale sentinel file must not appear in the new target
-            assert.ok(!(await exists(path.join(target, "stale.txt"))), "stale content must not leak into the new target");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-});
 describe("planDeploy path traversal", () => {
     it("throws when skill.path resolves to the repository root itself (.)", async () => {
         const sourceDir = await makeTmpDir();
@@ -1484,238 +1131,6 @@ describe("source directory immutability", () => {
         }
     });
 });
-describe("executeDeploy (Windows)", {
-    skip: process.platform !== "win32",
-}, () => {
-    it("creates copies on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            const target = actions[0]?.target;
-            assert.ok(await exists(target));
-            assert.ok(!(await lstat(target)).isSymbolicLink());
-            assert.ok(await exists(path.join(target, "SKILL.md")));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("registers deployment in registry on Windows copy deploy", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            const skillSource = await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            await executeDeploy(actions, false, false, home);
-            const target = actions[0]?.target;
-            const entry = await lookupDeployment(home, target);
-            assert.ok(entry);
-            if (entry.kind !== "skill-dir")
-                assert.fail("Expected skill-dir");
-            assert.equal(entry.skill, "test-skill");
-            assert.equal(entry.agent, "claude-code");
-            assert.equal(entry.source, skillSource);
-            assert.equal(entry.method, "copy");
-            assert.ok(!(await exists(path.join(skillSource, ".inception-totem"))));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("does not create copies in dry-run mode on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const { succeeded, failed } = await executeDeploy(actions, true, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            const target = actions[0]?.target;
-            assert.ok(!(await exists(target)));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("overwrites existing copy (with registry entry) on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            await executeDeploy(actions, false, false, home);
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("reports error for missing source (caught at planning)", async () => {
-        const home = await makeTmpDir();
-        try {
-            await assert.rejects(planDeploy(testManifest, "/nonexistent/source", ["claude-code"], home), (err) => {
-                assert.ok(err instanceof UserError);
-                assert.equal(err.code, "DEPLOY_FAILED");
-                assert.match(err.message, /source not found/);
-                return true;
-            });
-        }
-        finally {
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("refuses to overwrite unmanaged target on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            await mkdir(target, { recursive: true });
-            await writeFile(path.join(target, "something.txt"), "user content");
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            assert.ok(failed[0]?.error.includes("not managed by inception-engine"));
-            assert.ok(await exists(path.join(target, "something.txt")));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("refuses to overwrite target with mismatched registry entry on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            await mkdir(target, { recursive: true });
-            await writeFile(path.join(target, "SKILL.md"), "other content");
-            await registerDeployment(home, target, {
-                kind: "skill-dir",
-                source: "/completely/different/source",
-                skill: "different-skill",
-                agent: "codex",
-                method: "copy",
-            });
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            assert.ok(failed[0]?.error.includes("not managed by inception-engine"));
-            assert.ok(await exists(path.join(target, "SKILL.md")));
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("backup is removed after successful redeploy on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            await executeDeploy(actions, false, false, home);
-            await executeDeploy(actions, false, false, home);
-            assert.ok(!(await exists(backupPath)), "backup should not exist after successful redeploy");
-            assert.ok(await exists(target), "target should exist after redeploy");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-});
-describe("atomic redeploy behavior (Windows)", {
-    skip: process.platform !== "win32",
-}, () => {
-    it("cleans up stale .inception-backup from a previous failed attempt on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            await executeDeploy(actions, false, false, home);
-            await mkdir(backupPath, { recursive: true });
-            await writeFile(path.join(backupPath, "stale.txt"), "leftover");
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.equal(failed.length, 0);
-            assert.ok(!(await exists(backupPath)), "stale backup should be cleaned up");
-            assert.ok(await exists(target), "target should exist after redeploy");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("no backup is created on first deploy (no prior target) on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            const { succeeded } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 1);
-            assert.ok(await exists(target));
-            assert.ok(!(await exists(backupPath)), "no backup should be created when there was no prior target");
-        }
-        finally {
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-    it("restores backup when deploy fails (registry not writable) on Windows", async () => {
-        const sourceDir = await makeTmpDir();
-        const home = await makeTmpDir();
-        try {
-            await createSkillSource(sourceDir, "skills/test-skill");
-            const { actions } = await planDeploy(testManifest, sourceDir, ["claude-code"], home);
-            const target = actions[0]?.target;
-            const backupPath = `${target}.inception-backup`;
-            const { succeeded: firstSucceeded } = await executeDeploy(actions, false, false, home);
-            assert.equal(firstSucceeded, 1);
-            const registryFile = path.join(home, ".inception-engine", "registry.json");
-            await chmod(registryFile, 0o444); // trigger EPERM on Windows
-            const { succeeded, failed } = await executeDeploy(actions, false, false, home);
-            assert.equal(succeeded, 0);
-            assert.equal(failed.length, 1);
-            assert.ok(!(await exists(backupPath)), "backup should be gone after rollback");
-            assert.ok(await exists(target), "original target must be restored");
-            assert.ok(await exists(path.join(target, "SKILL.md")), "original content must be present");
-        }
-        finally {
-            try {
-                await chmod(path.join(home, ".inception-engine", "registry.json"), 0o666);
-            }
-            catch {
-                /* best effort */
-            }
-            await rm(sourceDir, { recursive: true, force: true });
-            await rm(home, { recursive: true, force: true });
-        }
-    });
-});
 describe("executeDeploy — file-write", () => {
     it("copies source file to target", async () => {
         const sourceDir = await makeTmpDir();