@mycadet/assistant 0.12.10 → 0.13.0

package/src/runtime/migrations/__tests__/gcs-signed-url.test.ts

@@ -1,254 +0,0 @@
-/**
- * Tests for the GCS signed-URL validator.
- *
- * Covers:
- * - A valid V4-signed URL (`X-Goog-Signature=...`) is accepted and the
- *   returned host/path match the input.
- * - A valid V2-signed URL (`Signature=...`) is accepted.
- * - `http://` is rejected with reason `scheme`.
- * - A non-GCS host is rejected with reason `host`.
- * - A GCS URL with no signature query param is rejected with reason
- *   `missing_signature`; SigV4 (`X-Amz-Signature`) is accepted only for
- *   hosts on a non-default allowlist, and unsigned URLs are rejected
- *   everywhere.
- * - A GCS URL with a non-default explicit port (e.g. `:1234`, `:80`) is
- *   rejected with reason `port`. A URL with `:443` is accepted because
- *   WHATWG URL normalizes the default HTTPS port to an empty port
- *   string.
- * - Path traversal (`/bucket/../foo`) is rejected with reason
- *   `path_traversal`, even though the URL parser would normalize it.
- * - Encoded-slash traversal (`%2e%2e%2fother`), backslash-separator
- *   traversal (`\..\secret`), uppercase percent encoding, and an
- *   encoded dot-dot at the start of the path are all rejected.
- * - A malformed URL string is rejected with reason `invalid_url`.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import { validateGcsSignedUrl } from "../gcs-signed-url.js";
-
-describe("validateGcsSignedUrl", () => {
-  test("accepts a V4-signed URL", () => {
-    const url =
-      "https://storage.googleapis.com/my-bucket/path/to/object.tgz" +
-      "?X-Goog-Algorithm=GOOG4-RSA-SHA256" +
-      "&X-Goog-Credential=service-account%40project.iam.gserviceaccount.com" +
-      "&X-Goog-Date=20260420T000000Z" +
-      "&X-Goog-Expires=3600" +
-      "&X-Goog-SignedHeaders=host" +
-      "&X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.host).toBe("storage.googleapis.com");
-      expect(result.path).toBe("/my-bucket/path/to/object.tgz");
-    }
-  });
-
-  test("accepts a V2-signed URL", () => {
-    const url =
-      "https://storage.googleapis.com/my-bucket/object.tgz" +
-      "?GoogleAccessId=service-account%40project.iam.gserviceaccount.com" +
-      "&Expires=1700000000" +
-      "&Signature=abc123";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.host).toBe("storage.googleapis.com");
-      expect(result.path).toBe("/my-bucket/object.tgz");
-    }
-  });
-
-  test("rejects http:// scheme", () => {
-    const url =
-      "http://storage.googleapis.com/my-bucket/object.tgz" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "scheme" });
-  });
-
-  test("accepts http:// for a host on a non-default allowlist", () => {
-    // A non-default allowlist (e.g. local/minikube where the bundle is
-    // served over http from host.docker.internal) relaxes the scheme check
-    // to also accept http and skips the explicit-port check.
-    const url =
-      "http://host.docker.internal:8000/bucket/object.tgz" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url, {
-      allowedHosts: ["host.docker.internal"],
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.host).toBe("host.docker.internal");
-      expect(result.path).toBe("/bucket/object.tgz");
-    }
-  });
-
-  test("still rejects a host absent from a non-default allowlist", () => {
-    const url =
-      "http://evil.internal/bucket/object.tgz" + "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url, {
-      allowedHosts: ["host.docker.internal"],
-    });
-    expect(result).toEqual({ ok: false, reason: "host" });
-  });
-
-  test("rejects a non-GCS host", () => {
-    const url =
-      "https://evil.com/my-bucket/object.tgz" + "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "host" });
-  });
-
-  test("rejects a GCS URL with no signature", () => {
-    const url = "https://storage.googleapis.com/bucket/key";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "missing_signature" });
-  });
-
-  test("accepts a SigV4-signed URL for a host on a non-default allowlist", () => {
-    // The local/minikube platform serves SigV4 presigned URLs (SeaweedFS)
-    // over plain http — X-Amz-Signature satisfies the signature-shape
-    // requirement for explicitly allowlisted hosts.
-    const url =
-      "http://host.docker.internal:8000/bucket/object.tgz" +
-      "?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url, {
-      allowedHosts: ["host.docker.internal"],
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.host).toBe("host.docker.internal");
-      expect(result.path).toBe("/bucket/object.tgz");
-    }
-  });
-
-  test("rejects an unsigned URL even on a non-default allowlist", () => {
-    const url = "http://host.docker.internal:8000/bucket/object.tgz";
-
-    const result = validateGcsSignedUrl(url, {
-      allowedHosts: ["host.docker.internal"],
-    });
-    expect(result).toEqual({ ok: false, reason: "missing_signature" });
-  });
-
-  test("rejects X-Amz-Signature on the default GCS allowlist", () => {
-    // SigV4 is only meaningful for allowlisted S3-compatible hosts; a GCS
-    // URL signed with the wrong scheme's param is not a GCS presigned URL.
-    const url =
-      "https://storage.googleapis.com/bucket/key?X-Amz-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "missing_signature" });
-  });
-
-  test("still rejects traversal in a SigV4-signed allowlisted URL", () => {
-    const url =
-      "http://host.docker.internal:8000/bucket/../secret" +
-      "?X-Amz-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url, {
-      allowedHosts: ["host.docker.internal"],
-    });
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects a GCS URL with a non-default port (1234)", () => {
-    const url =
-      "https://storage.googleapis.com:1234/bucket/key" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "port" });
-  });
-
-  test("rejects a GCS URL with HTTP default port (:80)", () => {
-    const url =
-      "https://storage.googleapis.com:80/bucket/key" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "port" });
-  });
-
-  test("accepts a GCS URL with explicit :443 (normalized to empty port)", () => {
-    // WHATWG URL normalizes `:443` to an empty port string for HTTPS,
-    // so the port check (`parsed.port !== ""`) does not reject it.
-    // A correctly-issued signed URL with an explicit default port is
-    // therefore unaffected by the port guard.
-    const url =
-      "https://storage.googleapis.com:443/my-bucket/object.tgz" +
-      "?X-Goog-Signature=deadbeef";
-
-    // Sanity-check the WHATWG normalization assumption.
-    expect(new URL(url).port).toBe("");
-
-    const result = validateGcsSignedUrl(url);
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.host).toBe("storage.googleapis.com");
-      expect(result.path).toBe("/my-bucket/object.tgz");
-    }
-  });
-
-  test("rejects path traversal", () => {
-    const url =
-      "https://storage.googleapis.com/bucket/../foo" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects path traversal with encoded slash (%2e%2e%2fother)", () => {
-    const url =
-      "https://storage.googleapis.com/bucket/%2e%2e%2fother" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects path traversal with backslash separators", () => {
-    // Note: the WHATWG URL parser normalizes `\` to `/` for special
-    // schemes like `https:`, so `new URL()` would collapse this to
-    // `/secret`. The raw-path guard must still reject it.
-    const url =
-      "https://storage.googleapis.com/bucket\\..\\secret" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects path traversal with uppercase percent encoding", () => {
-    const url =
-      "https://storage.googleapis.com/bucket/%2E%2E/other" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects encoded dot-dot at the start of the path", () => {
-    const url =
-      "https://storage.googleapis.com/%2e%2e/bucket/key" +
-      "?X-Goog-Signature=deadbeef";
-
-    const result = validateGcsSignedUrl(url);
-    expect(result).toEqual({ ok: false, reason: "path_traversal" });
-  });
-
-  test("rejects a malformed URL", () => {
-    const result = validateGcsSignedUrl("not a url at all");
-    expect(result).toEqual({ ok: false, reason: "invalid_url" });
-  });
-});

package/src/runtime/migrations/__tests__/job-registry.test.ts

@@ -1,346 +0,0 @@
-/**
- * Tests for the in-memory migration job registry.
- *
- * Covered:
- * - Happy path: start -> poll pending -> poll running -> poll complete with result.
- * - Failure path: runner throws -> job ends in `failed` with mapped error.
- * - `kFetchBodyError` path: tagged thrown object maps to `fetch_failed` with
- *   optional `upstreamStatus` preserved.
- * - Concurrent limit: second export while one is pending/running rejects with
- *   `JobAlreadyInProgressError`; a job of the other type is allowed alongside.
- * - TTL sweep: completed job older than the TTL is evicted; job that is not
- *   yet past TTL is retained.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import {
-  JobAlreadyInProgressError,
-  type MigrationJob,
-  MigrationJobRegistry,
-} from "../job-registry.js";
-
-const kFetchBodyError = Symbol.for("cadet.migrationImport.fetchBodyError");
-
-/** Spin the microtask queue N times so `queueMicrotask`-scheduled work runs. */
-async function flushMicrotasks(n = 4): Promise<void> {
-  for (let i = 0; i < n; i++) {
-    await Promise.resolve();
-  }
-}
-
-describe("MigrationJobRegistry", () => {
-  test("happy path: pending -> running -> complete with result", async () => {
-    const registry = new MigrationJobRegistry();
-
-    let release: (value: string) => void = () => {};
-    const gate = new Promise<string>((resolve) => {
-      release = resolve;
-    });
-
-    const job = registry.startJob("export", async (): Promise<string> => {
-      return await gate;
-    });
-
-    // Returned synchronously in pending state.
-    expect(job.status).toBe("pending");
-    expect(job.id).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
-    );
-    expect(job.type).toBe("export");
-    expect(job.createdAt).toBeGreaterThan(0);
-    expect(job.startedAt).toBeUndefined();
-    expect(job.completedAt).toBeUndefined();
-
-    // Let the microtask run -> status flips to running with `startedAt` set.
-    await flushMicrotasks();
-    const running = registry.getJob(job.id);
-    expect(running).not.toBeNull();
-    expect(running!.status).toBe("running");
-    expect(running!.startedAt).toBeGreaterThanOrEqual(running!.createdAt);
-
-    // Resolve the runner and let it settle.
-    release("the-result");
-    await flushMicrotasks();
-
-    const done = registry.getJob(job.id);
-    expect(done).not.toBeNull();
-    expect(done!.status).toBe("complete");
-    expect(done!.result).toBe("the-result");
-    expect(done!.completedAt).toBeGreaterThanOrEqual(done!.startedAt ?? 0);
-    expect(done!.error).toBeUndefined();
-
-    // `listJobs` sees it too.
-    expect(registry.listJobs().map((j) => j.id)).toContain(job.id);
-  });
-
-  test("failure path: runner throws -> failed with mapped error", async () => {
-    const registry = new MigrationJobRegistry();
-    const job = registry.startJob("export", async () => {
-      throw new Error("boom");
-    });
-
-    await flushMicrotasks();
-
-    const done = registry.getJob(job.id);
-    expect(done).not.toBeNull();
-    expect(done!.status).toBe("failed");
-    expect(done!.error).toEqual({ code: "unknown", message: "boom" });
-    expect(done!.result).toBeUndefined();
-    expect(done!.completedAt).toBeGreaterThanOrEqual(done!.startedAt ?? 0);
-  });
-
-  test("runner-provided `code` overrides the default `unknown`", async () => {
-    const registry = new MigrationJobRegistry();
-    const job = registry.startJob("import", async () => {
-      const err = new Error("invalid manifest") as Error & { code: string };
-      err.code = "invalid_manifest";
-      throw err;
-    });
-
-    await flushMicrotasks();
-
-    const done = registry.getJob(job.id);
-    expect(done!.status).toBe("failed");
-    expect(done!.error).toEqual({
-      code: "invalid_manifest",
-      message: "invalid manifest",
-    });
-  });
-
-  test("kFetchBodyError path: tagged error maps to `fetch_failed`", async () => {
-    const registry = new MigrationJobRegistry();
-    const job = registry.startJob("import", async () => {
-      const err = new Error("upstream hung up") as Error & {
-        upstreamStatus?: number;
-      };
-      (err as unknown as Record<symbol, boolean>)[kFetchBodyError] = true;
-      err.upstreamStatus = 502;
-      throw err;
-    });
-
-    await flushMicrotasks();
-
-    const done = registry.getJob(job.id);
-    expect(done).not.toBeNull();
-    expect(done!.status).toBe("failed");
-    expect(done!.error).toEqual({
-      code: "fetch_failed",
-      message: "upstream hung up",
-      upstreamStatus: 502,
-    });
-  });
-
-  test("kFetchBodyError without upstreamStatus omits the field", async () => {
-    const registry = new MigrationJobRegistry();
-    const job = registry.startJob("import", async () => {
-      const err = new Error("aborted") as Error;
-      (err as unknown as Record<symbol, boolean>)[kFetchBodyError] = true;
-      throw err;
-    });
-
-    await flushMicrotasks();
-
-    const done = registry.getJob(job.id)!;
-    expect(done.status).toBe("failed");
-    expect(done.error).toEqual({
-      code: "fetch_failed",
-      message: "aborted",
-    });
-    expect(done.error?.upstreamStatus).toBeUndefined();
-  });
-
-  test("concurrent limit: second same-type job rejects; other type is allowed", async () => {
-    const registry = new MigrationJobRegistry();
-
-    let release: () => void = () => {};
-    const gate = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-
-    // First export is pending (microtask hasn't run yet) — second export
-    // immediately rejects on the still-pending first job.
-    const first = registry.startJob("export", async () => {
-      await gate;
-    });
-    expect(first.status).toBe("pending");
-
-    expect(() => registry.startJob("export", async () => {})).toThrow(
-      JobAlreadyInProgressError,
-    );
-
-    // Advance to running — a same-type attempt still rejects.
-    await flushMicrotasks();
-    expect(registry.getJob(first.id)!.status).toBe("running");
-
-    let caught: unknown = null;
-    try {
-      registry.startJob("export", async () => {});
-    } catch (err) {
-      caught = err;
-    }
-    expect(caught).toBeInstanceOf(JobAlreadyInProgressError);
-    expect((caught as JobAlreadyInProgressError).existingJobId).toBe(first.id);
-
-    // A job of the *other* type is allowed in parallel.
-    const importJob = registry.startJob("import", async () => "ok");
-    expect(importJob.type).toBe("import");
-    expect(importJob.id).not.toBe(first.id);
-
-    // Settle both before leaving the test so no promises leak.
-    release();
-    await flushMicrotasks();
-    expect(registry.getJob(first.id)!.status).toBe("complete");
-    expect(registry.getJob(importJob.id)!.status).toBe("complete");
-
-    // And now a new export is allowed since nothing is in flight.
-    const third = registry.startJob("export", async () => "again");
-    expect(third.status).toBe("pending");
-    await flushMicrotasks();
-    expect(registry.getJob(third.id)!.status).toBe("complete");
-  });
-
-  test("returned job snapshots are decoupled from internal registry state", async () => {
-    const registry = new MigrationJobRegistry();
-
-    let release: () => void = () => {};
-    const gate = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-
-    const first = registry.startJob("export", async () => {
-      await gate;
-    });
-
-    // The synchronous return of startJob must be a snapshot, not the
-    // internal record. Mutating it (e.g. to simulate a caller stomping on
-    // `status`) must not unblock the single-in-flight invariant while the
-    // runner is still active.
-    first.status = "complete";
-    first.completedAt = Date.now();
-
-    await flushMicrotasks();
-    // Internal state is still running — the snapshot mutation did not leak.
-    expect(registry.getJob(first.id)!.status).toBe("running");
-
-    // Attempting a second same-type job must still reject.
-    expect(() => registry.startJob("export", async () => {})).toThrow(
-      JobAlreadyInProgressError,
-    );
-
-    // getJob snapshots are also decoupled: mutating the return value of
-    // getJob does not leak into listJobs or subsequent getJob calls.
-    const polled = registry.getJob(first.id)!;
-    polled.status = "failed";
-    expect(registry.getJob(first.id)!.status).toBe("running");
-    expect(registry.listJobs().find((j) => j.id === first.id)!.status).toBe(
-      "running",
-    );
-
-    // Settle.
-    release();
-    await flushMicrotasks();
-    expect(registry.getJob(first.id)!.status).toBe("complete");
-  });
-
-  test("TTL sweep: completed jobs older than TTL are evicted", async () => {
-    const registry = new MigrationJobRegistry();
-    registry.completedJobTtlMs = 1_000; // 1s for test purposes
-
-    const job = registry.startJob("export", async () => "done");
-    await flushMicrotasks();
-    const completed = registry.getJob(job.id)!;
-    expect(completed.status).toBe("complete");
-
-    // Before TTL: sweep is a no-op.
-    const originalNow = Date.now;
-    try {
-      Date.now = () => (completed.completedAt ?? 0) + 500;
-      registry.sweep();
-      expect(registry.getJob(job.id)).not.toBeNull();
-      expect(registry.listJobs().map((j) => j.id)).toContain(job.id);
-
-      // Past TTL: sweep evicts the completed job.
-      Date.now = () => (completed.completedAt ?? 0) + 2_000;
-      registry.sweep();
-      expect(registry.getJob(job.id)).toBeNull();
-      expect(registry.listJobs().map((j) => j.id)).not.toContain(job.id);
-    } finally {
-      Date.now = originalNow;
-    }
-  });
-
-  test("TTL sweep: failed jobs are also evicted past TTL", async () => {
-    const registry = new MigrationJobRegistry();
-    registry.completedJobTtlMs = 500;
-
-    const job = registry.startJob("import", async () => {
-      throw new Error("nope");
-    });
-    await flushMicrotasks();
-    const failed = registry.getJob(job.id)!;
-    expect(failed.status).toBe("failed");
-
-    const originalNow = Date.now;
-    try {
-      Date.now = () => (failed.completedAt ?? 0) + 10_000;
-      registry.sweep();
-      expect(registry.getJob(job.id)).toBeNull();
-    } finally {
-      Date.now = originalNow;
-    }
-  });
-
-  test("TTL sweep: running jobs are never evicted", async () => {
-    const registry = new MigrationJobRegistry();
-    registry.completedJobTtlMs = 1;
-
-    let release: () => void = () => {};
-    const gate = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-    const job = registry.startJob("export", async () => {
-      await gate;
-    });
-    await flushMicrotasks();
-    expect(registry.getJob(job.id)!.status).toBe("running");
-
-    const originalNow = Date.now;
-    try {
-      Date.now = () => Number.MAX_SAFE_INTEGER;
-      registry.sweep();
-      expect(registry.getJob(job.id)).not.toBeNull();
-    } finally {
-      Date.now = originalNow;
-    }
-
-    // Cleanup: let the runner resolve.
-    release();
-    await flushMicrotasks();
-  });
-
-  test("getJob returns null for unknown ids", () => {
-    const registry = new MigrationJobRegistry();
-    expect(registry.getJob("nope")).toBeNull();
-  });
-
-  test("JobAlreadyInProgressError carries the existing job id", () => {
-    const err = new JobAlreadyInProgressError("export", "abc-123");
-    expect(err).toBeInstanceOf(Error);
-    expect(err.name).toBe("JobAlreadyInProgressError");
-    expect(err.existingJobId).toBe("abc-123");
-    expect(err.message).toContain("export");
-    expect(err.message).toContain("abc-123");
-  });
-
-  test("MigrationJob interface shape is preserved on success", async () => {
-    const registry = new MigrationJobRegistry();
-    const job = registry.startJob("export", async () => ({ bytes: 42 }));
-    await flushMicrotasks();
-    const done: MigrationJob = registry.getJob(job.id)!;
-    expect(done.id).toBe(job.id);
-    expect(done.type).toBe("export");
-    expect(done.status).toBe("complete");
-    expect(done.result).toEqual({ bytes: 42 });
-  });
-});

package/src/runtime/migrations/__tests__/origin-mode.test.ts

@@ -1,62 +0,0 @@
-/**
- * Tests for `getOriginMode` — the vbundle manifest `origin.mode` derivation.
- *
- * Covers:
- * - `IS_CLOUD=true` → "managed" (wins over IS_CONTAINERIZED).
- * - `IS_CONTAINERIZED=true` (no IS_CLOUD) → "self-hosted-remote".
- * - Neither → "self-hosted-local".
- * - Regression: a logged-in local assistant holding cloud-proxy
- *   credentials (platform URL + assistant_api_key) must NOT be classified
- *   "managed" — every logged-in local has those credentials, and a
- *   "managed" stamp trips the importer's `secrets_redacted must be true
- *   when origin.mode is 'managed'` refine, breaking local→platform
- *   teleport. The helper keys on the IS_CLOUD deployment env only —
- *   nothing here consults the credential store, so the regression case is
- *   simply "no env flags set".
- */
-
-import { afterEach, describe, expect, test } from "bun:test";
-
-import { getOriginMode } from "../origin-mode.js";
-
-const ORIGINAL_IS_CLOUD = process.env.IS_CLOUD;
-const ORIGINAL_IS_CONTAINERIZED = process.env.IS_CONTAINERIZED;
-
-function restore(name: string, value: string | undefined): void {
-  if (value === undefined) {
-    delete process.env[name];
-  } else {
-    process.env[name] = value;
-  }
-}
-
-afterEach(() => {
-  restore("IS_CLOUD", ORIGINAL_IS_CLOUD);
-  restore("IS_CONTAINERIZED", ORIGINAL_IS_CONTAINERIZED);
-});
-
-describe("getOriginMode", () => {
-  test("IS_CLOUD=true → managed", async () => {
-    process.env.IS_CLOUD = "true";
-    delete process.env.IS_CONTAINERIZED;
-    expect(await getOriginMode()).toBe("managed");
-  });
-
-  test("IS_CLOUD wins over IS_CONTAINERIZED", async () => {
-    process.env.IS_CLOUD = "1";
-    process.env.IS_CONTAINERIZED = "true";
-    expect(await getOriginMode()).toBe("managed");
-  });
-
-  test("IS_CONTAINERIZED=true without IS_CLOUD → self-hosted-remote", async () => {
-    delete process.env.IS_CLOUD;
-    process.env.IS_CONTAINERIZED = "true";
-    expect(await getOriginMode()).toBe("self-hosted-remote");
-  });
-
-  test("neither flag → self-hosted-local (incl. logged-in locals with cloud-proxy creds)", async () => {
-    delete process.env.IS_CLOUD;
-    delete process.env.IS_CONTAINERIZED;
-    expect(await getOriginMode()).toBe("self-hosted-local");
-  });
-});