@namzu/sdk 14.0.7 → 15.0.0

package/src/utils/__tests__/abort-reason.test.ts

@@ -1,56 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { abortReasonText } from '../abort.js'
-
-/**
- * A cancellation and a deadline arrive by the same mechanism and mean opposite
- * things to whoever reads the result. The distinction only survives if the
- * words a caller attached travel with the abort — and only if the words the
- * platform invents on a caller's behalf do NOT, because a fabricated
- * explanation is worse than an honest silence.
- */
-
-describe('a stop carries the words its caller gave it', () => {
-	it('reports a reason someone wrote', () => {
-		expect(abortReasonText(new Error('deployment window closed'))).toBe('deployment window closed')
-	})
-
-	it('reports a named deadline, which is the case this exists for', () => {
-		const reason = new Error('run budget of 30000ms exhausted')
-		expect(abortReasonText(reason)).toBe('run budget of 30000ms exhausted')
-	})
-})
-
-describe('a stop with nothing to say stays silent', () => {
-	it('says nothing for a bare abort()', () => {
-		// `abort()` with no argument fills `reason` with a DOMException named
-		// AbortError. Nobody wrote that word; it is the platform's way of
-		// saying the caller gave no reason, and rendering it would turn "we
-		// do not know" into what looks like an answer.
-		const controller = new AbortController()
-		controller.abort()
-
-		expect(controller.signal.reason).toBeInstanceOf(Error)
-		expect((controller.signal.reason as Error).name).toBe('AbortError')
-		expect(abortReasonText(controller.signal.reason)).toBeUndefined()
-	})
-
-	it('says nothing for a platform timeout', () => {
-		const timeout = new Error('The operation was aborted due to timeout')
-		timeout.name = 'TimeoutError'
-		expect(abortReasonText(timeout)).toBeUndefined()
-	})
-
-	it('says nothing for a non-Error reason', () => {
-		// The agent manager aborts a child with the bare string 'canceled'.
-		// Rendering it produces "was cancelled: canceled" — noise wearing the
-		// shape of information.
-		expect(abortReasonText('canceled')).toBeUndefined()
-		expect(abortReasonText(undefined)).toBeUndefined()
-		expect(abortReasonText({ message: 'not an Error' })).toBeUndefined()
-	})
-
-	it('says nothing for an Error whose message is empty', () => {
-		expect(abortReasonText(new Error('   '))).toBeUndefined()
-	})
-})

package/src/utils/__tests__/atomic-write.test.ts

@@ -1,108 +0,0 @@
-import { mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-
-import { atomicWriteFile, temporaryPathFor } from '../atomic-write.js'
-
-/**
- * The rename is what makes the write atomic — a reader sees the old file or
- * the new one, never a half-written one. The sidecar it renames FROM has to
- * be private to this write, and in seven places it was a fixed
- * `${path}.tmp`.
- *
- * Two writers of the same record then shared one scratch file: both opened
- * it, both wrote into it, and the first rename published whatever mixture
- * had landed while the second renamed a file that was no longer there. That
- * is the failure atomic writes exist to prevent, reached through the
- * mechanism meant to prevent it.
- *
- * Not hypothetical here: the cross-process park and unpark handoff is a
- * design where two processes legitimately touch the same records, and it is
- * the feature these stores exist to serve.
- */
-
-let dir: string
-
-beforeEach(() => {
-	dir = mkdtempSync(join(tmpdir(), 'namzu-atomic-'))
-})
-
-afterEach(() => {
-	rmSync(dir, { recursive: true, force: true })
-})
-
-describe('the sidecar name', () => {
-	it('is different every time', () => {
-		const names = new Set(Array.from({ length: 1000 }, () => temporaryPathFor('/x/record.json')))
-		// A thousand writes in the same millisecond is a batch, not a stress
-		// test — a timestamp alone would collide here.
-		expect(names.size).toBe(1000)
-	})
-
-	it('stays beside the file it will become', () => {
-		expect(temporaryPathFor('/x/record.json').startsWith('/x/record.json.')).toBe(true)
-		// Same directory, so the rename is within one filesystem and stays
-		// atomic rather than degrading to a copy.
-		expect(temporaryPathFor('/x/record.json')).toMatch(/\.tmp$/)
-	})
-
-	it('carries the process id, so two processes cannot pick the same one', () => {
-		expect(temporaryPathFor('/x/record.json')).toContain(`.${process.pid}.`)
-	})
-})
-
-describe('writing', () => {
-	it('publishes the content', async () => {
-		const target = join(dir, 'record.json')
-		await atomicWriteFile(target, '{"a":1}')
-		expect(readFileSync(target, 'utf-8')).toBe('{"a":1}')
-	})
-
-	it('leaves no sidecar behind on success', async () => {
-		await atomicWriteFile(join(dir, 'record.json'), 'x')
-		expect(readdirSync(dir)).toEqual(['record.json'])
-	})
-
-	it('leaves no sidecar behind on failure', async () => {
-		// A directory that does not exist fails the write, not the rename.
-		await expect(atomicWriteFile(join(dir, 'missing', 'record.json'), 'x')).rejects.toThrow()
-		// A leftover sidecar looks like a record to anything scanning the
-		// directory, and the next attempt would not reuse it anyway.
-		expect(readdirSync(dir)).toEqual([])
-	})
-
-	it('does not corrupt a record when two writes race', async () => {
-		const target = join(dir, 'record.json')
-		const first = 'a'.repeat(200_000)
-		const second = 'b'.repeat(200_000)
-
-		await Promise.all([atomicWriteFile(target, first), atomicWriteFile(target, second)])
-
-		// One of them won; neither produced a mixture. With a shared sidecar
-		// this is exactly where the halves interleave.
-		const written = readFileSync(target, 'utf-8')
-		expect([first, second]).toContain(written)
-		expect(readdirSync(dir)).toEqual(['record.json'])
-	})
-
-	it('survives many concurrent writes to the same record', async () => {
-		const target = join(dir, 'record.json')
-		const bodies = Array.from({ length: 25 }, (_, i) => `${i}`.repeat(50_000))
-
-		await Promise.all(bodies.map((body) => atomicWriteFile(target, body)))
-
-		expect(bodies).toContain(readFileSync(target, 'utf-8'))
-		expect(readdirSync(dir)).toEqual(['record.json'])
-	})
-})
-
-describe('a contended rename', () => {
-	it('does not retry a failure that is not contention', async () => {
-		// A missing directory is a permanent condition; retrying it would
-		// turn a clear failure into a delay and then the same failure.
-		const started = Date.now()
-		await expect(atomicWriteFile(join(dir, 'nope', 'record.json'), 'x')).rejects.toThrow()
-		expect(Date.now() - started).toBeLessThan(50)
-	})
-})

package/src/utils/__tests__/shell-compress.test.ts

@@ -1,49 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { compressShellOutputFull } from '../shell-compress.js'
-
-/**
- * `raw` here is bash stdout, and bash stdout is not something the run
- * itself typed — a fetched page, a piped response, a file an agent was
- * told to `cat`, all land in it verbatim. The pass-line detector's opening
- * alternative used to hunt for a PASS/ok marker with an unbounded
- * whitespace/bullet run in front of it. On a long line that never produces
- * that marker, the engine restarts the hunt at every offset in the line,
- * and this codebase's tool budgets cap payload bytes, not line length —
- * one crafted line was enough to pin a core testing the regex, and would
- * have done the same to the process compressing real output.
- */
-describe('compressShellOutputFull', () => {
-	it('does not hang on a long marker-free line (js/polynomial-redos regression)', () => {
-		// 20 lines is `DEFAULT_MIN_LINES` — below it the function returns the
-		// input untouched and the vulnerable regex is never reached.
-		const poison = ' '.repeat(4000)
-		const raw = [poison, ...Array.from({ length: 19 }, (_, i) => `line ${i}`)].join('\n')
-
-		const start = Date.now()
-		compressShellOutputFull(raw)
-		const elapsedMs = Date.now() - start
-
-		// The vulnerable regex takes ~20s on a line this size; a fixed one
-		// finishes in low single-digit milliseconds. 1s leaves headroom for a
-		// loaded CI box while still failing hard on a regression.
-		expect(elapsedMs).toBeLessThan(1000)
-	})
-
-	it('still recognizes and suppresses repeated PASS markers', () => {
-		// Distinct names, not indices: normalizeLine folds digits to `N`, so
-		// index-numbered lines would collapse into one another in the repeat
-		// pass and the assertion below would be measuring the wrong thing.
-		const names = ['alpha', 'bravo', 'charlie', 'delta', 'echo', 'foxtrot', 'golf', 'hotel']
-		const passLines = names.map((name) => `  ✓ test ${name} PASS `)
-		const raw = [...passLines, ...Array.from({ length: 15 }, (_, i) => `other line ${i}`)].join(
-			'\n',
-		)
-
-		const { text } = compressShellOutputFull(raw, { maxPassLines: 3 })
-
-		expect(text).toContain('passing tests omitted')
-		// Only the configured cap of PASS lines survives verbatim.
-		expect(text.match(/✓ test \w+ PASS/g)?.length).toBe(3)
-	})
-})

package/src/vault/instrumentation.test.ts

@@ -1,98 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { createProbeRegistry } from '../probe/registry.js'
-import type { AgentBusEvent } from '../types/bus/index.js'
-import type { CredentialId, TenantId } from '../types/ids/index.js'
-
-import { InMemoryCredentialVault } from './InMemoryCredentialVault.js'
-import { wrapVaultWithProbes } from './instrumentation.js'
-
-const tenant = 'tnt_acme' as TenantId
-const connector = 'conn_x' as never
-
-describe('wrapVaultWithProbes', () => {
-	it('emits vault_lookup with found:true when retrieve hits', async () => {
-		const reg = createProbeRegistry()
-		const seen: AgentBusEvent[] = []
-		reg.onAny((event) => seen.push(event as AgentBusEvent))
-
-		const inner = new InMemoryCredentialVault()
-		const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' } as never)
-		const wrapped = wrapVaultWithProbes(inner, { probes: reg, vaultId: 'in-memory' })
-
-		const result = await wrapped.retrieve(ref.id)
-		expect(result).toBeDefined()
-		expect(seen.length).toBe(1)
-		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
-		expect(event.type).toBe('vault_lookup')
-		expect(event.found).toBe(true)
-		expect(event.vaultId).toBe('in-memory')
-		expect(event.credentialId).toBe(ref.id)
-	})
-
-	it('emits vault_lookup with found:false when retrieve misses', async () => {
-		const reg = createProbeRegistry()
-		const seen: AgentBusEvent[] = []
-		reg.onAny((event) => seen.push(event as AgentBusEvent))
-
-		const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), {
-			probes: reg,
-			vaultId: 'in-memory',
-		})
-		const missing = 'cred_missing' as CredentialId
-		const result = await wrapped.retrieve(missing)
-
-		expect(result).toBeUndefined()
-		expect(seen.length).toBe(1)
-		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
-		expect(event.found).toBe(false)
-		expect(event.credentialId).toBe(missing)
-	})
-
-	it('does not emit on store/revoke/list — retrieve is the audit point', async () => {
-		const reg = createProbeRegistry()
-		const seen: AgentBusEvent[] = []
-		reg.onAny((event) => seen.push(event as AgentBusEvent))
-
-		const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), { probes: reg })
-		const ref = await wrapped.store(tenant, connector, 'k', {
-			type: 'apiKey',
-			apiKey: 's',
-		} as never)
-		await wrapped.list(tenant)
-		await wrapped.revoke(ref.id)
-		expect(seen.length).toBe(0)
-	})
-
-	it('does not leak the secret value in the emitted event', async () => {
-		const reg = createProbeRegistry()
-		const seen: AgentBusEvent[] = []
-		reg.onAny((event) => seen.push(event as AgentBusEvent))
-
-		const inner = new InMemoryCredentialVault()
-		const ref = await inner.store(tenant, connector, 'k', {
-			type: 'apiKey',
-			apiKey: 'super-secret-value',
-		} as never)
-		const wrapped = wrapVaultWithProbes(inner, { probes: reg })
-		await wrapped.retrieve(ref.id)
-
-		const event = seen[0]
-		const serialized = JSON.stringify(event)
-		expect(serialized).not.toContain('super-secret-value')
-	})
-
-	it('falls back to constructor.name as vaultId when not specified', async () => {
-		const reg = createProbeRegistry()
-		const seen: AgentBusEvent[] = []
-		reg.onAny((event) => seen.push(event as AgentBusEvent))
-
-		const inner = new InMemoryCredentialVault()
-		const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' } as never)
-		const wrapped = wrapVaultWithProbes(inner, { probes: reg })
-		await wrapped.retrieve(ref.id)
-
-		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
-		expect(event.vaultId).toBe('InMemoryCredentialVault')
-	})
-})

package/src/verification/__tests__/argument-pattern.test.ts

@@ -1,158 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import type { ToolDefinition } from '../../types/tool/index.js'
-import type { VerificationGateConfig, VerificationRule } from '../../types/verification/index.js'
-import { getRootLogger } from '../../utils/logger.js'
-import { VerificationGate } from '../gate.js'
-
-/**
- * Every pattern rule an operator could write was one of two wrong things.
- *
- * `custom_pattern` carries no tool scope, so a rule written about `bash`
- * decided `edit` calls as well. And `target: 'args'` tests
- * `JSON.stringify(toolInput)`, so the subject is the JSON TEXT of the whole
- * argument object — meaning the natural, anchored thing to write
- * (`^git push.*$`) can never match, and the rule silently decides nothing.
- * Pinning the tool cost the anchor; anchoring cost the tool scope.
- */
-
-function gate(rules: VerificationGateConfig['rules']): VerificationGate {
-	return new VerificationGate(
-		{
-			enabled: true,
-			rules,
-			allowReadOnlyTools: false,
-			denyDangerousPatterns: false,
-			logDecisions: false,
-		} as VerificationGateConfig,
-		getRootLogger(),
-	)
-}
-
-/** Only the fields the gate reads. */
-function toolDef(name: string): ToolDefinition {
-	return { name, isReadOnly: () => false } as unknown as ToolDefinition
-}
-
-const PUSH_RULE: VerificationRule = {
-	type: 'argument_pattern',
-	toolNames: ['bash'],
-	argument: 'command',
-	pattern: '^git push',
-	decision: 'deny',
-}
-
-function evaluate(
-	rules: VerificationGateConfig['rules'],
-	toolName: string,
-	toolInput: unknown,
-): ReturnType<VerificationGate['evaluate']> {
-	return gate(rules).evaluate({ toolName, toolInput, toolDef: toolDef(toolName) })
-}
-
-describe('a rule can name one tool and one argument at once', () => {
-	it('denies the call it was written about', () => {
-		const result = evaluate([PUSH_RULE], 'bash', { command: 'git push origin main' })
-		expect(result.decision).toBe('deny')
-	})
-
-	it('anchors against the value, which is what the old rule could not do', () => {
-		// The whole defect in one assertion: this same pattern under
-		// `custom_pattern` with `target: 'args'` is tested against
-		// `{"command":"git push origin main"}`, where `^git push` cannot match
-		// because the string does not start there.
-		const viaOldRule = evaluate(
-			[{ type: 'custom_pattern', pattern: '^git push', target: 'args', decision: 'deny' }],
-			'bash',
-			{ command: 'git push origin main' },
-		)
-		expect(viaOldRule.decision, 'the old rule silently decided nothing').not.toBe('deny')
-
-		expect(evaluate([PUSH_RULE], 'bash', { command: 'git push origin main' }).decision).toBe('deny')
-	})
-
-	it('leaves a different tool alone', () => {
-		// The other half: a rule about `bash` used to decide `edit` too,
-		// because the pattern was matched against a serialisation that has no
-		// idea which tool produced it.
-		const result = evaluate([PUSH_RULE], 'edit', { command: 'git push origin main' })
-		expect(result.decision).not.toBe('deny')
-	})
-
-	it('leaves a different argument alone', () => {
-		const result = evaluate([PUSH_RULE], 'bash', { description: 'git push origin main' })
-		expect(result.decision).not.toBe('deny')
-	})
-
-	it('says which argument decided, so a model knows whether to reword', () => {
-		const result = evaluate([PUSH_RULE], 'bash', { command: 'git push origin main' })
-
-		expect(result.reason).toContain('command')
-		expect(result.reason).toContain('^git push')
-		expect(result.reason).toContain('bash')
-	})
-})
-
-describe('what it deliberately does not decide', () => {
-	it('decides nothing when the argument is absent', () => {
-		const result = evaluate([PUSH_RULE], 'bash', {})
-		expect(result.decision).not.toBe('deny')
-	})
-
-	it('decides nothing about a structured argument', () => {
-		// No string a pattern could match says anything true about an object,
-		// and serialising it to try would put this rule back where
-		// `custom_pattern` already is. An operator who needs to refuse a tool
-		// over the SHAPE of its input wants deny_by_name.
-		const rule: VerificationRule = { ...PUSH_RULE, argument: 'env', pattern: 'PROD' }
-		const result = evaluate([rule], 'bash', { env: { NODE_ENV: 'PROD' } })
-
-		expect(result.decision).not.toBe('deny')
-	})
-
-	it('reads a number or a boolean rather than skipping it', () => {
-		// These render unambiguously, so skipping them would be a fail-open
-		// with no upside: a rule about a numeric argument is a rule someone
-		// can reasonably write.
-		const rule: VerificationRule = {
-			type: 'argument_pattern',
-			toolNames: ['sleep'],
-			argument: 'seconds',
-			pattern: '^[0-9]{4,}$',
-			decision: 'deny',
-		}
-
-		expect(evaluate([rule], 'sleep', { seconds: 86400 }).decision).toBe('deny')
-		expect(evaluate([rule], 'sleep', { seconds: 5 }).decision).not.toBe('deny')
-	})
-})
-
-describe('a rule that cannot be compiled decides nothing at all', () => {
-	it('does not widen into a rule about the whole tool', () => {
-		// The failure this forbids: a typo'd regex turning "deny bash when its
-		// command matches X" into "deny bash" — a far larger authorization than
-		// anybody wrote, granted by a mistake nobody would notice.
-		//
-		// What actually secures it is the missing-pattern check at the top of
-		// `evaluateRule`, which returns before the tool name is consulted. The
-		// gate's construction order (compile first, only then record the names)
-		// is defence in depth and NOT the mechanism: reversing those two lines
-		// fails nothing, which was measured rather than assumed. So this test
-		// pins the OUTCOME and the comment in the gate says which line to keep.
-		const broken: VerificationRule = { ...PUSH_RULE, pattern: '([unclosed' }
-		const result = evaluate([broken], 'bash', { command: 'ls' })
-
-		expect(result.decision).not.toBe('deny')
-	})
-
-	it('is secured by the pattern check, not by the construction order', () => {
-		// The honest version of the mutation: remove the check that actually
-		// holds and this fails. A rule whose pattern never compiled has no
-		// pattern to test, so it must decide nothing even for a tool it names.
-		const broken: VerificationRule = { ...PUSH_RULE, pattern: '([unclosed' }
-
-		expect(evaluate([broken], 'bash', { command: 'git push origin main' }).decision).not.toBe(
-			'deny',
-		)
-	})
-})

package/src/verification/__tests__/rule-order-and-reason.test.ts

@@ -1,149 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import type { ToolDefinition } from '../../types/tool/index.js'
-import type { VerificationGateConfig } from '../../types/verification/index.js'
-import { getRootLogger } from '../../utils/logger.js'
-import { VerificationGate, describeRule } from '../gate.js'
-
-/**
- * Two things an operator has to be able to trust about a policy gate: that a
- * rule they wrote is consulted, and that a refusal says enough to act on.
- *
- * Neither held. `allowReadOnlyTools` was expanded into a rule AHEAD of the
- * operator's own, and the gate stops at the first match — so "prompt me before
- * every read" was not rejected, not warned about, just never reached. And a
- * denial arrived as the rule's TYPE NAME, which tells a model that a rule
- * matched and nothing whatever about what it said.
- */
-
-function gate(config: Partial<VerificationGateConfig>): VerificationGate {
-	return new VerificationGate(
-		{
-			enabled: true,
-			rules: [],
-			allowReadOnlyTools: false,
-			denyDangerousPatterns: false,
-			logDecisions: false,
-			...config,
-		} as VerificationGateConfig,
-		getRootLogger(),
-	)
-}
-
-/** Only the fields the gate reads. */
-function toolDef(name: string, readOnly: boolean): ToolDefinition {
-	return { name, isReadOnly: () => readOnly } as unknown as ToolDefinition
-}
-
-describe('an operator rule outranks the read-only convenience', () => {
-	it('lets a rule make a read-only tool prompt', () => {
-		// The case that was silently unreachable: `read` observes only, the
-		// convenience is on, and the operator has asked to be consulted anyway.
-		const result = gate({
-			allowReadOnlyTools: true,
-			rules: [{ type: 'deny_by_name', toolNames: ['read'] }],
-		}).evaluate({
-			toolName: 'read',
-			toolInput: { path: 'notes.txt' },
-			toolDef: toolDef('read', true),
-		})
-
-		expect(result.decision, 'the operator rule was never consulted').toBe('deny')
-	})
-
-	it('still allows a read-only tool nobody wrote a rule about', () => {
-		// The convenience keeps doing its job as a DEFAULT, which is what it
-		// always was in substance.
-		const result = gate({
-			allowReadOnlyTools: true,
-			rules: [{ type: 'deny_by_name', toolNames: ['write'] }],
-		}).evaluate({
-			toolName: 'grep',
-			toolInput: { pattern: 'x' },
-			toolDef: toolDef('grep', true),
-		})
-
-		expect(result.decision).toBe('allow')
-	})
-})
-
-describe('the safety floor still outranks everything', () => {
-	it('refuses a dangerous pattern even when a rule would allow the tool', () => {
-		// The denial goes first and stays there. An operator rule must not be
-		// able to open what it closes.
-		const result = gate({
-			denyDangerousPatterns: true,
-			rules: [{ type: 'allow_by_name', toolNames: ['bash'] }],
-		}).evaluate({
-			toolName: 'bash',
-			toolInput: { command: 'rm -rf /' },
-			toolDef: toolDef('bash', false),
-		})
-
-		expect(result.decision).toBe('deny')
-	})
-})
-
-describe('a refusal says what the rule said', () => {
-	it('names the pattern rather than the rule type', () => {
-		// "Matched rule: custom_pattern" tells a model a rule matched and
-		// nothing about it, so it rewords the same call and tries again. The
-		// pattern is what makes the retry visibly pointless.
-		const reason = describeRule({
-			type: 'custom_pattern',
-			pattern: 'git push*',
-			target: 'args',
-			decision: 'deny',
-		})
-
-		expect(reason).toContain('git push*')
-		expect(reason).toContain('denied')
-		expect(reason).not.toContain('custom_pattern')
-	})
-
-	it('says a by-name denial is about the tool, not the input', () => {
-		// The distinction that decides the next move: reworded arguments will
-		// not help, so the model should stop rather than iterate.
-		const reason = describeRule({ type: 'deny_by_name', toolNames: ['bash', 'write'] })
-
-		expect(reason).toContain('bash')
-		expect(reason).toContain('a different input will not change it')
-	})
-
-	it('says a dangerous-pattern refusal is not worth rewording', () => {
-		expect(describeRule({ type: 'deny_dangerous_patterns' })).toContain('will not help')
-	})
-
-	it('reaches the model through the gate result, not just the helper', () => {
-		const result = gate({ rules: [{ type: 'deny_by_name', toolNames: ['bash'] }] }).evaluate({
-			toolName: 'bash',
-			toolInput: { command: 'ls' },
-			toolDef: toolDef('bash', false),
-		})
-
-		expect(result.reason).toContain('bash')
-		expect(result.reason).not.toMatch(/^Matched rule:/)
-	})
-
-	it('is reachable by a caller driving the rules without the gate', async () => {
-		// `evaluateRule` is public and answers only WHETHER a rule matched. A
-		// caller holding that verdict and no describer is back to switching on
-		// the rule's type for its wording — the same defect the gate carried,
-		// one layer up. So the two travel together, and this asserts the
-		// PAIRING rather than either one alone.
-		//
-		// Asserted at this barrel rather than the package barrel on purpose.
-		// Importing `../../index.js` costs ~4s of module-graph load — measured,
-		// on an idle machine, against a default 5s test budget — so the version
-		// of this test that looked stronger was one busy CI runner away from
-		// failing for a reason that has nothing to do with verification. The
-		// package half is gated better elsewhere anyway: the public-surface
-		// baseline resolves `dist/index.d.ts` through the checker and reports a
-		// REGRESSION naming any symbol that leaves the surface.
-		const barrel = await import('../index.js')
-
-		expect(typeof barrel.evaluateRule).toBe('function')
-		expect(typeof barrel.describeRule).toBe('function')
-		expect(barrel.describeRule({ type: 'deny_by_name', toolNames: ['bash'] })).toContain('bash')
-	})
-})