@ngocsangairvds/vsaf 4.0.6 → 4.0.8

package/skills/vds-skill/vds-scripts/vds_cli/src/vds_cli/sync_service.py

@@ -0,0 +1,283 @@
+"""macOS LaunchAgent service manager for watch-agents sync daemon."""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import plistlib
+import shutil
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+from vds_cli_common.paths import get_vds_log_root
+
+LABEL = "com.vds.watch-agents"
+
+
+@dataclass(frozen=True)
+class ServicePaths:
+    """Resolved paths for the LaunchAgent service."""
+
+    plist: Path
+    stdout_log: Path
+    stderr_log: Path
+    vds_cli_bin: Path
+    project_dir: Path
+    repo_root: Path
+
+
+class ServiceError(RuntimeError):
+    """Error during LaunchAgent service management."""
+
+
+def _find_vds_cli() -> Path:
+    """Locate the ``vds-cli`` binary on PATH or standard install locations.
+
+    Prefers the PATH-resolved, tool-installed binary (Phase 173 FR-11) so the
+    daemon does NOT trigger a workspace-wide ``uv run --project`` resolve on
+    every start. The workspace resolve drags URL-pinned wheels from unrelated
+    members (e.g. ``en-core-web-sm`` via ``memory_orchestrator`` and
+    ``pdf_orchestrator``) into the critical path and times out on
+    LAN-restricted networks.
+
+    Install with: ``uv tool install --editable ~/.claude/vds-scripts/vds_cli``.
+    """
+    which = shutil.which("vds-cli")
+    if which:
+        return Path(which).resolve()
+    for candidate in (
+        Path.home() / ".local" / "bin" / "vds-cli",
+        Path("/usr/local/bin/vds-cli"),
+        Path("/opt/homebrew/bin/vds-cli"),
+    ):
+        if candidate.exists():
+            return candidate.resolve()
+    raise ServiceError(
+        "Cannot find 'vds-cli' binary. Install with: uv tool install --editable ~/.claude/vds-scripts/vds_cli"
+    )
+
+
+def _resolve_project_dir() -> Path:
+    """Resolve the vds_cli project directory from this module's location."""
+    # This file lives at: <project_dir>/src/vds_cli/sync_service.py
+    src_dir = Path(__file__).resolve().parent.parent  # src/
+    project_dir = src_dir.parent  # vds_cli/
+    if not (project_dir / "pyproject.toml").exists():
+        raise ServiceError(f"Cannot resolve vds_cli project dir from {__file__}")
+    return project_dir
+
+
+def _resolve_repo_root(project_dir: Path) -> Path:
+    """Walk up from project dir to find repo root (contains AGENTS.md)."""
+    candidate = project_dir
+    for _ in range(10):
+        if (candidate / "AGENTS.md").exists():
+            return candidate
+        parent = candidate.parent
+        if parent == candidate:
+            break
+        candidate = parent
+    raise ServiceError(f"Cannot find repo root (AGENTS.md) walking up from {project_dir}")
+
+
+def resolve_paths(*, repo_root: Path | None = None) -> ServicePaths:
+    """Build all service-related paths."""
+    vds_cli_bin = _find_vds_cli()
+    project_dir = _resolve_project_dir()
+    if repo_root is None:
+        repo_root = _resolve_repo_root(project_dir)
+
+    log_dir = get_vds_log_root()
+    return ServicePaths(
+        plist=Path.home() / "Library" / "LaunchAgents" / f"{LABEL}.plist",
+        stdout_log=log_dir / "watch-agents.stdout.log",
+        stderr_log=log_dir / "watch-agents.stderr.log",
+        vds_cli_bin=vds_cli_bin,
+        project_dir=project_dir,
+        repo_root=repo_root,
+    )
+
+
+def build_plist(paths: ServicePaths) -> dict:
+    """Build the LaunchAgent plist dictionary.
+
+    Invokes the tool-installed ``vds-cli`` binary directly (Phase 173 FR-11)
+    instead of ``uv run --project``. This avoids workspace-wide lock resolution
+    on every restart — a workspace resolve pulls URL-pinned wheels (e.g.
+    ``en-core-web-sm``) from unrelated members and blows up on LAN-restricted
+    networks, which is what caused the ``SyncFileLock`` flap storm observed
+    before FR-11 alignment.
+
+    ``ThrottleInterval`` is pinned to ``reconcile_interval_seconds`` (300s) in
+    ``docs_sync.py`` — restart cadence matches the inner loop's cadence, so a
+    restart storm cannot outpace a single reconcile cycle.
+    """
+    return {
+        "Label": LABEL,
+        "ProgramArguments": [
+            str(paths.vds_cli_bin),
+            "docs",
+            "watch-agents",
+            "--repo-root",
+            str(paths.repo_root),
+        ],
+        "WorkingDirectory": str(paths.repo_root),
+        "RunAtLoad": True,
+        "KeepAlive": {
+            "SuccessfulExit": False,  # restart on non-zero exit
+        },
+        "ThrottleInterval": 300,  # aligns with reconcile_interval_seconds in docs_sync.py
+        "StandardOutPath": str(paths.stdout_log),
+        "StandardErrorPath": str(paths.stderr_log),
+        "EnvironmentVariables": {
+            "PATH": f"{paths.vds_cli_bin.parent}:/usr/local/bin:/usr/bin:/bin",
+            "HOME": str(Path.home()),
+        },
+    }
+
+
+def install(*, repo_root: Path | None = None, force: bool = False) -> ServicePaths:
+    """Install and load the LaunchAgent.
+
+    Returns the resolved paths for caller diagnostics.
+    """
+    if sys.platform != "darwin":
+        raise ServiceError("LaunchAgent install is only supported on macOS.")
+
+    paths = resolve_paths(repo_root=repo_root)
+
+    if paths.plist.exists() and not force:
+        raise ServiceError(f"Service already installed at {paths.plist}. Use --force to overwrite.")
+
+    # Unload existing if overwriting
+    if paths.plist.exists():
+        _launchctl("bootout", ignore_errors=True)
+
+    # Ensure directories exist
+    paths.plist.parent.mkdir(parents=True, exist_ok=True)
+    paths.stdout_log.parent.mkdir(parents=True, exist_ok=True)
+
+    # Write plist
+    plist_data = build_plist(paths)
+    with open(paths.plist, "wb") as fh:
+        plistlib.dump(plist_data, fh)
+
+    # Load service
+    _launchctl("bootstrap")
+
+    return paths
+
+
+def uninstall() -> Path:
+    """Unload and remove the LaunchAgent. Returns the plist path that was removed."""
+    if sys.platform != "darwin":
+        raise ServiceError("LaunchAgent uninstall is only supported on macOS.")
+
+    paths = resolve_paths()
+
+    if not paths.plist.exists():
+        raise ServiceError(f"Service not installed (no plist at {paths.plist}).")
+
+    _launchctl("bootout", ignore_errors=True)
+    paths.plist.unlink(missing_ok=True)
+
+    return paths.plist
+
+
+@dataclass(frozen=True)
+class ServiceStatus:
+    """Diagnostic snapshot of the LaunchAgent service."""
+
+    installed: bool
+    plist_path: Path
+    running: bool
+    pid: int | None
+    exit_code: int | None
+    label: str = LABEL
+
+
+def status() -> ServiceStatus:
+    """Query the current service state."""
+    if sys.platform != "darwin":
+        raise ServiceError("LaunchAgent status is only supported on macOS.")
+
+    paths = resolve_paths()
+    installed = paths.plist.exists()
+
+    if not installed:
+        return ServiceStatus(
+            installed=False,
+            plist_path=paths.plist,
+            running=False,
+            pid=None,
+            exit_code=None,
+        )
+
+    running, pid, exit_code = _query_launchctl()
+    return ServiceStatus(
+        installed=True,
+        plist_path=paths.plist,
+        running=running,
+        pid=pid,
+        exit_code=exit_code,
+    )
+
+
+def _launchctl(action: str, *, ignore_errors: bool = False) -> None:
+    """Run launchctl bootstrap/bootout for the user domain."""
+    uid = os.getuid()
+    domain_target = f"gui/{uid}"
+    plist_path = Path.home() / "Library" / "LaunchAgents" / f"{LABEL}.plist"
+
+    if action == "bootstrap":
+        cmd = ["launchctl", "bootstrap", domain_target, str(plist_path)]
+    elif action == "bootout":
+        cmd = ["launchctl", "bootout", f"{domain_target}/{LABEL}"]
+    else:
+        raise ServiceError(f"Unknown launchctl action: {action}")
+
+    try:
+        subprocess.run(cmd, check=True, capture_output=True, text=True)
+    except subprocess.CalledProcessError as exc:
+        if not ignore_errors:
+            raise ServiceError(f"launchctl {action} failed (exit {exc.returncode}): {exc.stderr.strip()}") from exc
+
+
+def _query_launchctl() -> tuple[bool, int | None, int | None]:
+    """Query launchctl for service state. Returns (running, pid, exit_code)."""
+    uid = os.getuid()
+    service_target = f"gui/{uid}/{LABEL}"
+
+    try:
+        result = subprocess.run(
+            ["launchctl", "print", service_target],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except FileNotFoundError:
+        return False, None, None
+
+    if result.returncode != 0:
+        return False, None, None
+
+    output = result.stdout
+    pid: int | None = None
+    exit_code: int | None = None
+    running = False
+
+    for line in output.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("pid = "):
+            try:
+                pid = int(stripped.split("=", 1)[1].strip())
+                running = True
+            except ValueError:
+                pass
+        elif stripped.startswith("last exit code ="):
+            with contextlib.suppress(ValueError):
+                exit_code = int(stripped.split("=", 1)[1].strip())
+
+    return running, pid, exit_code

package/skills/vds-skill/vds-scripts/vds_cli/tests/conftest.py

@@ -0,0 +1,62 @@
+"""Pytest configuration and fixtures."""
+
+import os
+from pathlib import Path
+
+import pytest
+
+
+@pytest.fixture
+def mock_env_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """Create a temporary .env file for testing."""
+    env_file = tmp_path / ".vds" / ".env"
+    env_file.parent.mkdir(parents=True, exist_ok=True)
+    env_file.write_text(
+        "VDS_USERNAME=test_user\n"
+        "VDS_PASSWORD=test_pass\n"
+        "BITBUCKET_ACCESS_TOKEN=test_token\n"
+        "INTERNAL_CONFLUENCE_TOKEN=test_internal\n"
+        "EXTERNAL_CONFLUENCE_TOKEN=test_external\n"
+    )
+    # Mock Path.home() to return our test directory
+    monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
+    return env_file
+
+
+@pytest.fixture
+def mock_script_dir(tmp_path: Path) -> Path:
+    """Create a mock scripts directory with orchestrators."""
+    orchestrators = {
+        "jira_orchestrator": "vds-jira-cli",
+        "confluence_orchestrator": "vds-confluence-cli",
+        "bitbucket_orchestrator": "vds-bitbucket-cli",
+        "git_orchestrator": "vds-git-orchestrator",
+        "spec_orchestrator": "vds-spec",
+        "circular_dependency_orchestrator": "vds-circular-dependency",
+        "vds_evolution": "vds-evolution",
+    }
+    for name, entry in orchestrators.items():
+        project_dir = tmp_path / name
+        project_dir.mkdir(parents=True, exist_ok=True)
+        src_module_dir = project_dir / "src" / "mock"
+        src_module_dir.mkdir(parents=True, exist_ok=True)
+        (src_module_dir / "__init__.py").write_text("", encoding="utf-8")
+        (src_module_dir / "cli.py").write_text("def app() -> None:\n    return None\n", encoding="utf-8")
+        (project_dir / "pyproject.toml").write_text(
+            f'[project]\nname = "mock-orchestrator"\nversion = "0.0.1"\n[project.scripts]\n{entry} = "mock.cli:app"\n',
+            encoding="utf-8",
+        )
+    return tmp_path
+
+
+@pytest.fixture
+def mock_home_dir(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """Mock home directory for environment file."""
+    monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
+    return tmp_path
+
+
+@pytest.fixture
+def credentials_available() -> bool:
+    """Check if real credentials are available for verification tests."""
+    return bool(os.getenv("VDS_USERNAME") and os.getenv("VDS_PASSWORD") and os.getenv("BITBUCKET_ACCESS_TOKEN"))

package/skills/vds-skill/vds-scripts/vds_cli/tests/test_env_git_helper_lifecycle.py

@@ -0,0 +1,261 @@
+"""Lifecycle tests for vds_cli.env_git_helper.
+
+Spec: who-ecosystem-alignment Phase 5 v0.7.0 — TSK-5.27.
+
+Per .claude/rules/common/testing.md, no real `git config --global` mutations.
+Mock boundaries explicit (NOT generic 'subprocess mocking'):
+- `subprocess.run` patched at module level for git config + self-probe
+- `pathlib.Path.home` monkeypatched for filesystem isolation
+- All file ops happen inside tmp_path
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from vds_cli import env_git_helper as egh
+
+
+class MockSubprocessRun:
+    """Records subprocess.run calls; routes by command shape."""
+
+    def __init__(self, git_config_value: str = "") -> None:
+        self.calls: list[tuple[list[str], dict]] = []
+        self.git_config_value = git_config_value
+
+    def __call__(self, args, **kwargs) -> subprocess.CompletedProcess:
+        self.calls.append((list(args), dict(kwargs)))
+        # `git config --global --get credential.helper` → return configured value
+        if isinstance(args, list) and "config" in args and "--get" in args:
+            stdout = (self.git_config_value + "\n") if self.git_config_value else ""
+            rc = 0 if self.git_config_value else 1
+            return subprocess.CompletedProcess(args=args, returncode=rc, stdout=stdout, stderr="")
+        # Self-probe (helper invocation): pretend allowlist-miss success
+        if isinstance(args, list) and args and str(args[0]).endswith("git-credential-vds"):
+            return subprocess.CompletedProcess(args=args, returncode=0, stdout="", stderr="")
+        # Default: success
+        return subprocess.CompletedProcess(args=args, returncode=0, stdout="", stderr="")
+
+
+@pytest.fixture
+def mock_run(monkeypatch: pytest.MonkeyPatch) -> MockSubprocessRun:
+    runner = MockSubprocessRun()
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", runner)
+    return runner
+
+
+@pytest.fixture
+def fake_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
+    (tmp_path / ".vds").mkdir(parents=True, exist_ok=True)
+    return tmp_path
+
+
+def _matching_signature_content() -> str:
+    """Pre-FR-24 helper signature per AC-24.6 (contains VDS_USERNAME + def cmd_get)."""
+    return "# legacy helper\nimport os\ndef cmd_get():\n    return os.environ.get('VDS_USERNAME')\n"
+
+
+# ---------------------------------------------------------------------------
+# (a) AC-23.2(e), AC-24.4 — install removes pre-FR-24 file artifacts
+# ---------------------------------------------------------------------------
+def test_a_install_removes_pre_fr24_artifacts(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    # Place stub artifacts that match the AC-24.6 signature
+    legacy_main = fake_home / ".vds" / "git_credential_helper.py"
+    legacy_bak = fake_home / ".vds" / "git_credential_helper.py.bak"
+    legacy_main.write_text(_matching_signature_content(), encoding="utf-8")
+    legacy_bak.write_text(_matching_signature_content(), encoding="utf-8")
+
+    result = egh.install()
+
+    assert not legacy_main.exists(), "Should remove signature-matching .py legacy"
+    assert not legacy_bak.exists(), "Should remove signature-matching .bak legacy"
+    assert legacy_main in result.removed
+    assert legacy_bak in result.removed
+
+
+# ---------------------------------------------------------------------------
+# (b) AC-24.6 — install preserves user-authored file (signature mismatch)
+# ---------------------------------------------------------------------------
+def test_b_install_preserves_user_file_when_signature_mismatch(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    user_file = fake_home / ".vds" / "git_credential_helper.py"
+    user_file.write_text("# my unrelated script\nprint('hello')\n", encoding="utf-8")
+
+    result = egh.install()
+
+    assert user_file.exists(), "User file MUST be preserved when signature mismatches"
+    assert user_file in result.preserved
+    assert user_file not in result.removed
+
+
+# ---------------------------------------------------------------------------
+# (c) AC-24.5 — install migrates legacy state file
+# ---------------------------------------------------------------------------
+def test_c_install_migrates_legacy_state_file(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    legacy_state = fake_home / ".vds" / ".git_helper_state.json"
+    new_state = fake_home / ".vds" / ".git-credential-helper-cooldown.json"
+    payload = {"failures": [1234.5, 1235.0], "cooldown_until": 0}
+    legacy_state.write_text(json.dumps(payload), encoding="utf-8")
+
+    result = egh.install()
+
+    assert not legacy_state.exists(), "Legacy state must be removed after migration"
+    assert new_state.exists(), "New state must exist after migration"
+    assert json.loads(new_state.read_text()) == payload
+    assert result.migrated_state == new_state
+
+
+# ---------------------------------------------------------------------------
+# (d) AC-23.7 — install creates ~/.vds/bin/ with mode 0o700
+# ---------------------------------------------------------------------------
+def test_d_install_creates_bin_dir_with_0700(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    egh.install()
+    bin_dir = fake_home / ".vds" / "bin"
+    assert bin_dir.is_dir()
+    mode = bin_dir.stat().st_mode & 0o777
+    assert mode == 0o700, f"~/.vds/bin/ mode must be 0o700, got {oct(mode)}"
+
+
+# ---------------------------------------------------------------------------
+# (e) AC-23.7 — installed binary is mode 0o700, NOT 0o755
+# ---------------------------------------------------------------------------
+def test_e_install_binary_is_0700(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    result = egh.install()
+    assert result.target.exists()
+    mode = result.target.stat().st_mode & 0o777
+    assert mode == 0o700, f"Installed binary mode must be 0o700, got {oct(mode)}"
+
+
+# ---------------------------------------------------------------------------
+# (f) AC-23.8 — all subprocess.run calls in install use shell=False with list args
+# ---------------------------------------------------------------------------
+def test_f_install_uses_shell_false_and_list_args(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    egh.install()
+    assert mock_run.calls, "install must invoke subprocess.run at least once"
+    for args, kwargs in mock_run.calls:
+        assert isinstance(args, list), f"args must be list, got {type(args).__name__}: {args}"
+        assert kwargs.get("shell", False) is False, f"shell must be False, got {kwargs.get('shell')!r}"
+
+
+# ---------------------------------------------------------------------------
+# (g) AC-23.3 — verify exit 0 on clean install
+# ---------------------------------------------------------------------------
+def test_g_verify_exit_0_on_clean_install(fake_home: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    egh.install.__wrapped__ if hasattr(egh.install, "__wrapped__") else None
+    # First install (with mock_run for the install step)
+    install_runner = MockSubprocessRun()
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", install_runner)
+    result = egh.install()
+    # Now swap to a verify-mock that reports the correct configured path
+    verify_runner = MockSubprocessRun(git_config_value=str(result.target.resolve()))
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", verify_runner)
+
+    exit_code, checks = egh.verify()
+    assert exit_code == 0, f"verify should pass; checks: {checks}"
+    assert all(c.ok for c in checks)
+
+
+# ---------------------------------------------------------------------------
+# (h) AC-23.3 — verify exit 1 when git config points to wrong path
+# ---------------------------------------------------------------------------
+def test_h_verify_exit_1_on_wrong_git_config(fake_home: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    install_runner = MockSubprocessRun()
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", install_runner)
+    egh.install()
+    # git config points to a different unrelated helper
+    bad_runner = MockSubprocessRun(git_config_value="/usr/local/bin/something-else")
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", bad_runner)
+
+    exit_code, checks = egh.verify()
+    assert exit_code == 1
+    assert any(c.name == "Git config" and not c.ok for c in checks)
+
+
+# ---------------------------------------------------------------------------
+# (i) AC-23.3 — verify exit 1 when binary is non-executable
+# ---------------------------------------------------------------------------
+def test_i_verify_exit_1_on_non_executable_binary(fake_home: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    install_runner = MockSubprocessRun()
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", install_runner)
+    result = egh.install()
+    # Strip exec bits
+    import os as _os
+
+    _os.chmod(result.target, 0o644)
+    runner = MockSubprocessRun(git_config_value=str(result.target.resolve()))
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", runner)
+
+    exit_code, checks = egh.verify()
+    assert exit_code == 1
+    assert any(c.name == "Executable" and not c.ok for c in checks)
+
+
+# ---------------------------------------------------------------------------
+# (j) AC-21.4 + AC-23.3 — verify --reset-cooldown clears state file
+# ---------------------------------------------------------------------------
+def test_j_verify_reset_cooldown_clears_state(fake_home: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    state_file = fake_home / ".vds" / ".git-credential-helper-cooldown.json"
+    state_file.write_text(
+        json.dumps({"failures": [1.0, 2.0, 3.0], "cooldown_until": 9_999_999_999}),
+        encoding="utf-8",
+    )
+    runner = MockSubprocessRun()
+    monkeypatch.setattr("vds_cli.env_git_helper.subprocess.run", runner)
+
+    _exit_code, checks = egh.verify(reset_cooldown=True)
+
+    cleared = json.loads(state_file.read_text())
+    assert cleared == {"failures": [], "cooldown_until": 0}
+    assert any(c.name == "Cooldown reset" and c.ok for c in checks)
+
+
+# ---------------------------------------------------------------------------
+# (k) AC-23.4 — remove is idempotent when nothing is installed
+# ---------------------------------------------------------------------------
+def test_k_remove_idempotent_when_nothing_installed(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    # No install — bin dir missing entirely
+    result = egh.remove()
+    assert result["deleted_binary"] is False
+    assert result["deleted_state"] is False
+    # No exception raised → success
+
+
+# ---------------------------------------------------------------------------
+# (l) AC-23.4 — remove --purge deletes state file
+# ---------------------------------------------------------------------------
+def test_l_remove_purge_deletes_state_file(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    state_file = fake_home / ".vds" / ".git-credential-helper-cooldown.json"
+    state_file.write_text(json.dumps({"failures": [], "cooldown_until": 0}), encoding="utf-8")
+
+    result = egh.remove(purge=True)
+
+    assert not state_file.exists(), "State file must be deleted by --purge"
+    assert result["deleted_state"] is True
+
+
+# ---------------------------------------------------------------------------
+# (m) AC-23.5 — status() reports installed/missing/broken correctly
+# ---------------------------------------------------------------------------
+def test_m_status_reports_three_states(fake_home: Path, mock_run: MockSubprocessRun) -> None:
+    # Missing: nothing installed
+    state, hint = egh.status()
+    assert state == "missing"
+    assert "vds-cli env install-git-helper" in hint
+
+    # Installed: install + check
+    egh.install()
+    state, hint = egh.status()
+    assert state == "installed"
+    assert hint == ""
+
+    # Broken: chmod 0o644
+    import os as _os
+
+    _os.chmod(fake_home / ".vds" / "bin" / "git-credential-vds", 0o644)
+    state, hint = egh.status()
+    assert state == "broken"
+    assert "vds-cli env install-git-helper" in hint