@ngocsangairvds/vsaf 4.1.7 → 4.1.9

package/skills/vds-skill/vds-scripts/vds_cli/tests/test_git_credential_helper.py

@@ -1,240 +0,0 @@
-"""Unit tests for the canonical git credential helper.
-
-Spec: who-ecosystem-alignment Phase 5 v0.7.0 — TSK-5.22.
-
-Per AC-25.1 the helper must NOT be importable in a venv-requiring way; tests
-invoke it via subprocess.run (NEVER via import) so the test runtime mirrors
-git's bare-shell invocation context.
-
-Each test sets HOME to tmp_path via subprocess env, so the helper reads the
-test's tmp .vds/.env rather than the developer's real one (avoids flakiness).
-"""
-
-from __future__ import annotations
-
-import ast
-import json
-import os
-import re
-import subprocess
-import sys
-import time
-from pathlib import Path
-
-ASSET_PATH = Path(__file__).parent.parent / "src" / "vds_cli" / "assets" / "git-credential-helper.py"
-
-
-def _run(
-    action: str, stdin: str, home: Path, *, extra_env: dict[str, str] | None = None
-) -> subprocess.CompletedProcess[str]:
-    """Invoke the helper as git would, with HOME isolated to tmp."""
-    env = {"HOME": str(home), "PATH": os.environ["PATH"]}
-    if extra_env:
-        env.update(extra_env)
-    return subprocess.run(
-        [sys.executable, str(ASSET_PATH), action],
-        input=stdin,
-        capture_output=True,
-        text=True,
-        env=env,
-        timeout=10,
-    )
-
-
-def _write_env(home: Path, content: str) -> None:
-    env_dir = home / ".vds"
-    env_dir.mkdir(parents=True, exist_ok=True)
-    (env_dir / ".env").write_text(content, encoding="utf-8")
-
-
-def _read_state(home: Path) -> dict:
-    state_file = home / ".vds" / ".git-credential-helper-cooldown.json"
-    return json.loads(state_file.read_text(encoding="utf-8"))
-
-
-# ---------------------------------------------------------------------------
-# (a) AC-20.1, AC-20.2 — allowlist-miss returns no output, exit 0
-# ---------------------------------------------------------------------------
-def test_a_allowlist_miss_returns_no_output(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    result = _run("get", "protocol=https\nhost=github.com\n\n", tmp_path)
-    assert result.returncode == 0
-    assert result.stdout == ""
-
-
-# ---------------------------------------------------------------------------
-# (b) AC-20.3, FR-19 — token preferred over basic when both present
-# ---------------------------------------------------------------------------
-def test_b_token_preference_over_basic(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=user\nVDS_PASSWORD=basicpw\nBITBUCKET_TOKEN=tokenval\n")
-    result = _run("get", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    assert result.returncode == 0
-    assert "username=user\n" in result.stdout
-    assert "password=tokenval\n" in result.stdout
-    assert "basicpw" not in result.stdout
-
-
-# ---------------------------------------------------------------------------
-# (c) AC-21.1 — erase increments failures
-# ---------------------------------------------------------------------------
-def test_c_erase_increments_failures(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    _run("erase", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    state = _read_state(tmp_path)
-    assert len(state["failures"]) == 1
-
-
-# ---------------------------------------------------------------------------
-# (d) AC-21.2 — 3 failures in 60s triggers cooldown
-# ---------------------------------------------------------------------------
-def test_d_three_failures_trigger_cooldown(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    for _ in range(3):
-        _run("erase", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    state = _read_state(tmp_path)
-    assert state["cooldown_until"] > time.time()
-    assert state["failures"] == []
-
-
-# ---------------------------------------------------------------------------
-# (e) AC-21.3 — store resets state
-# ---------------------------------------------------------------------------
-def test_e_store_resets_state(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    for _ in range(3):
-        _run("erase", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    _run("store", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    state = _read_state(tmp_path)
-    assert state["cooldown_until"] == 0
-    assert state["failures"] == []
-
-
-# ---------------------------------------------------------------------------
-# (f) AC-20.4 — dotenv parser handles export, quotes, comments, blank lines
-# ---------------------------------------------------------------------------
-def test_f_dotenv_variants(tmp_path: Path) -> None:
-    content = (
-        "# leading comment\n"
-        "\n"
-        "export VDS_USERNAME=quser\n"
-        "VDS_PASSWORD='single-quoted'\n"
-        'BITBUCKET_TOKEN="double-quoted-tok"\n'
-        "# trailing comment\n"
-    )
-    _write_env(tmp_path, content)
-    result = _run("get", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    assert result.returncode == 0
-    assert "username=quser\n" in result.stdout
-    assert "password=double-quoted-tok\n" in result.stdout  # token wins over basic
-
-
-# ---------------------------------------------------------------------------
-# (g) AC-20.5, NFR-12 — stderr never contains credential substrings
-# ---------------------------------------------------------------------------
-def test_g_no_stderr_credential_disclosure(tmp_path: Path) -> None:
-    secret_pw = "supersecret-pw-XYZ-7777"
-    secret_tok = "tok-leak-canary-9999"
-    _write_env(tmp_path, f"VDS_USERNAME=u\nVDS_PASSWORD={secret_pw}\nBITBUCKET_TOKEN={secret_tok}\n")
-    result = _run("get", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    assert result.returncode == 0
-    assert secret_pw not in result.stderr
-    assert secret_tok not in result.stderr
-
-
-# ---------------------------------------------------------------------------
-# (h) AC-21.4 — state file is human-inspectable JSON with correct schema
-# ---------------------------------------------------------------------------
-def test_h_state_file_schema(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    for _ in range(3):
-        _run("erase", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    state = _read_state(tmp_path)
-    assert "cooldown_until" in state
-    assert "failures" in state
-    assert isinstance(state["failures"], list)
-    assert isinstance(state["cooldown_until"], (int, float))
-
-
-# ---------------------------------------------------------------------------
-# (i) AC-21.6 — cooldown stderr notice matches r"in cooldown until \d+s"
-# ---------------------------------------------------------------------------
-def test_i_cooldown_stderr_notice_format(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    # Pre-populate cooldown state
-    state_file = tmp_path / ".vds" / ".git-credential-helper-cooldown.json"
-    state_file.parent.mkdir(parents=True, exist_ok=True)
-    state_file.write_text(json.dumps({"failures": [], "cooldown_until": time.time() + 240}))
-    result = _run("get", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    assert result.returncode == 0
-    assert result.stdout == ""  # cooldown means silent fall-through
-    assert re.search(r"in cooldown until \d+s", result.stderr) is not None
-
-
-# ---------------------------------------------------------------------------
-# (j) AC-25.1 — every Import/ImportFrom resolves to a stdlib module
-# ---------------------------------------------------------------------------
-def test_j_stdlib_only_imports() -> None:
-    source = ASSET_PATH.read_text(encoding="utf-8")
-    tree = ast.parse(source)
-    non_stdlib: list[str] = []
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Import):
-            for alias in node.names:
-                top = alias.name.split(".")[0]
-                if top not in sys.stdlib_module_names:
-                    non_stdlib.append(top)
-        elif isinstance(node, ast.ImportFrom) and node.module:
-            top = node.module.split(".")[0]
-            if top not in sys.stdlib_module_names:
-                non_stdlib.append(top)
-    assert non_stdlib == [], f"Helper imports non-stdlib modules: {non_stdlib}"
-
-
-# ---------------------------------------------------------------------------
-# (k) AC-25.5 — module docstring present and cites FR-25
-# ---------------------------------------------------------------------------
-def test_k_module_docstring_cites_fr25() -> None:
-    source = ASSET_PATH.read_text(encoding="utf-8")
-    tree = ast.parse(source)
-    docstring = ast.get_docstring(tree)
-    assert docstring is not None and docstring.strip(), "Helper missing module docstring"
-    assert "FR-25" in docstring, f"Module docstring must cite FR-25; got: {docstring[:200]}..."
-
-
-# ---------------------------------------------------------------------------
-# (l) AC-21.7 — state file mode is 0o600 after a write
-# ---------------------------------------------------------------------------
-def test_l_state_file_mode_0600(tmp_path: Path) -> None:
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    _run("erase", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    state_file = tmp_path / ".vds" / ".git-credential-helper-cooldown.json"
-    mode = state_file.stat().st_mode & 0o777
-    assert mode == 0o600, f"State file mode should be 0o600, got {oct(mode)}"
-
-
-# ---------------------------------------------------------------------------
-# (m) AC-19.5 — whitespace-only token treated as absent (basic-auth fallback)
-# ---------------------------------------------------------------------------
-def test_m_whitespace_token_treated_as_absent(tmp_path: Path) -> None:
-    _write_env(tmp_path, 'VDS_USERNAME=u\nVDS_PASSWORD=basicpw\nBITBUCKET_TOKEN="   "\n')
-    result = _run("get", "protocol=https\nhost=bitbucket.digital.vn\n\n", tmp_path)
-    assert result.returncode == 0
-    # Whitespace token is treated as absent; helper falls back to basic auth.
-    assert "password=basicpw\n" in result.stdout
-
-
-# ---------------------------------------------------------------------------
-# (n) AC-20.6 — VDS_BITBUCKET_HOSTS only honored from .env, never shell env
-# ---------------------------------------------------------------------------
-def test_n_allowlist_only_from_env_file(tmp_path: Path) -> None:
-    # .env does NOT extend allowlist
-    _write_env(tmp_path, "VDS_USERNAME=u\nVDS_PASSWORD=p\n")
-    # Shell env attempts to extend — must be ignored
-    result = _run(
-        "get",
-        "protocol=https\nhost=evil.example.com\n\n",
-        tmp_path,
-        extra_env={"VDS_BITBUCKET_HOSTS": "evil.example.com"},
-    )
-    assert result.returncode == 0
-    assert result.stdout == "", "Helper must NOT read VDS_BITBUCKET_HOSTS from shell env"

package/skills/vds-skill/vds-scripts/vds_cli/tests/test_router_help_proxy.py

@@ -1,43 +0,0 @@
-"""Unit tests for router --help proxy (FR-2, Phase 174).
-
-Verifies that PASS_THRU_CONTEXT commands delegate --help and -h to the
-underlying orchestrator via _run_service, instead of letting Typer intercept
-them and show its own one-line docstring.
-"""
-
-from unittest.mock import patch
-
-from typer.testing import CliRunner
-from vds_cli.cli import app
-
-runner = CliRunner()
-
-
-def test_router_help_delegates_to_service() -> None:
-    """vds-cli jira --help must delegate to _run_service, not show Typer's help."""
-    with patch("vds_cli.cli._run_service") as mock_run:
-        runner.invoke(app, ["jira", "--help"])
-        mock_run.assert_called_once()
-        service, args = mock_run.call_args.args
-        assert service == "jira"
-        assert "--help" in args
-
-
-def test_router_help_short_form() -> None:
-    """vds-cli jira -h must also delegate to _run_service."""
-    with patch("vds_cli.cli._run_service") as mock_run:
-        runner.invoke(app, ["jira", "-h"])
-        mock_run.assert_called_once()
-        service, args = mock_run.call_args.args
-        assert service == "jira"
-        assert "-h" in args
-
-
-def test_router_no_args_still_works() -> None:
-    """vds-cli jira with no extra args still routes to _run_service without crashing."""
-    with patch("vds_cli.cli._run_service") as mock_run:
-        runner.invoke(app, ["jira"])
-        mock_run.assert_called_once()
-        service, args = mock_run.call_args.args
-        assert service == "jira"
-        assert args == []

package/skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli.py

@@ -1,241 +0,0 @@
-"""Unit tests for CLI commands.
-
-Based on pytest v8.3.3+ API
-Context7: /pytest-dev/pytest
-Key Features: Fixtures, CliRunner, @pytest.mark.skipif
-"""
-
-from pathlib import Path
-from unittest.mock import Mock, patch
-
-import pytest
-from typer.testing import CliRunner
-from vds_cli.cli import app
-from vds_cli.router import ORCHESTRATORS
-
-runner = CliRunner()
-
-
-def test_cli_version() -> None:
-    """Test version command."""
-    result = runner.invoke(app, ["version"])
-    assert result.exit_code == 0
-    assert "v4.0.0" in result.stdout
-
-
-def test_cli_help() -> None:
-    """Test help command."""
-    result = runner.invoke(app, ["--help"])
-    assert result.exit_code == 0
-    assert "VDS Platform CLI" in result.stdout
-    assert "env" in result.stdout
-    assert "git" in result.stdout
-    assert "jira" in result.stdout
-
-
-def test_docs_help_exposes_watch_agents() -> None:
-    """Docs command group should expose watch-agents subcommand."""
-    result = runner.invoke(app, ["docs", "--help"])
-    assert result.exit_code == 0
-    assert "watch-agents" in result.stdout
-    assert "validate" in result.stdout
-    assert "freshness" in result.stdout
-    assert "Instruction document synchronization operations" in result.stdout
-
-
-def test_docs_watch_agents_once(tmp_path: Path) -> None:
-    """watch-agents should run one startup reconciliation and exit with --once."""
-    base = "# Shared instructions\\n\\n- baseline\\n"
-    (tmp_path / ".github").mkdir(parents=True, exist_ok=True)
-    (tmp_path / "AGENTS.md").write_text(base, encoding="utf-8")
-    (tmp_path / "CLAUDE.md").write_text(base, encoding="utf-8")
-    (tmp_path / ".github" / "copilot-instructions.md").write_text(base, encoding="utf-8")
-
-    result = runner.invoke(
-        app,
-        [
-            "docs",
-            "watch-agents",
-            "--once",
-            "--repo-root",
-            str(tmp_path),
-            "--no-log-json",
-        ],
-    )
-    assert result.exit_code == 0
-
-
-@pytest.mark.skip(
-    reason=(
-        "telegram-bridge disabled until aiogram >=3.28.0 ships "
-        "(pydantic >=2.13 compat blocker); see vds-ai-memory-skill SKILL.md line 188. "
-        "ORCHESTRATORS still lists 'telegram', so the help-output assertion fails. "
-        "Re-enable when aiogram is unblocked."
-    )
-)
-def test_router_commands_exposed_in_cli_help() -> None:
-    """Every router service should be exposed as a vds-cli command."""
-    result = runner.invoke(app, ["--help"])
-    assert result.exit_code == 0
-
-    help_text = result.stdout
-    for service in ORCHESTRATORS:
-        command_name = service.replace("_", "-")
-        assert command_name in help_text
-
-
-def test_cli_env_load(mock_env_file: Path) -> None:
-    """Test env load command."""
-    with patch("vds_cli.cli.load_environment") as mock_load:
-        from vds_cli.env import VDSSettings
-
-        mock_settings = VDSSettings()
-        mock_settings.vds_username = "test_user"
-        mock_load.return_value = mock_settings
-
-        result = runner.invoke(app, ["env", "load"])
-        assert result.exit_code == 0
-        assert "Loading" in result.stdout or "loaded" in result.stdout.lower()
-
-
-def test_cli_env_status(mock_env_file: Path) -> None:
-    """Test env status command."""
-    with patch("vds_cli.cli.load_environment") as mock_load:
-        from vds_cli.env import VDSSettings
-
-        mock_settings = VDSSettings()
-        mock_settings.bitbucket_access_token = "test_token"
-        mock_load.return_value = mock_settings
-
-        result = runner.invoke(app, ["env", "status"])
-        assert result.exit_code == 0
-        assert "Environment Status" in result.stdout or "Status" in result.stdout
-
-
-def test_cli_env_invalid_action() -> None:
-    """Test env command with invalid action.
-
-    Typer/argparse returns exit code 2 for unknown subcommands; older versions
-    returned 1. Accept either to remain version-resilient.
-    """
-    result = runner.invoke(app, ["env", "invalid"])
-    assert result.exit_code in (1, 2)
-    combined = (result.stdout + (result.stderr or "")).lower()
-    assert "unknown action" in combined or "invalid" in combined or "no such command" in combined
-
-
-@patch("vds_cli.cli.run_orchestrator")
-@patch("vds_cli.cli.load_environment")
-def test_cli_git_command(mock_load: Mock, mock_run: Mock, mock_script_dir: Path) -> None:
-    """Test git command routing."""
-    mock_run.return_value = 0
-    # Configure mock settings to return strings for environment variables
-    mock_settings = Mock()
-    mock_settings.vds_git_projects = "lep,insurance"
-    mock_settings.vds_bitbucket_http_base = "http://bitbucket.example.com"
-    mock_settings.vds_git_auto_regenerate_manifest = "0"
-    mock_load.return_value = mock_settings
-
-    with patch("vds_cli.cli.SCRIPT_DIR", mock_script_dir):
-        # Typer Argument(...) expects variadic args, so we pass them separately
-        result = runner.invoke(app, ["git", "status", "--match", "*service*"])
-        # Exit code 2 means Typer parsing error - this is expected if orchestrator path doesn't exist
-        # The important thing is that run_orchestrator was called
-        assert result.exit_code in [0, 2]  # Allow for path issues
-        # If exit code is 0, verify the call
-        if result.exit_code == 0:
-            mock_run.assert_called_once_with("git", ["status", "--match", "*service*"], mock_script_dir)
-
-
-@patch("vds_cli.cli.run_orchestrator")
-@patch("vds_cli.cli.load_environment")
-def test_cli_jira_command(mock_load: Mock, mock_run: Mock, mock_script_dir: Path) -> None:
-    """Test jira command routing."""
-    mock_run.return_value = 0
-    mock_load.return_value = Mock()
-
-    with patch("vds_cli.cli.SCRIPT_DIR", mock_script_dir):
-        # Pass arguments separately - Typer will parse them
-        result = runner.invoke(app, ["jira", "search", "project", "=", "NTTC", "--limit", "20"])
-        # Exit code 2 means Typer parsing error - this is expected if orchestrator path doesn't exist
-        # The important thing is that run_orchestrator was called
-        assert result.exit_code in [0, 2]  # Allow for path issues
-        # If exit code is 0, verify the call was made
-        if result.exit_code == 0:
-            assert mock_run.called
-
-
-@patch("vds_cli.cli.run_orchestrator")
-def test_cli_confluence_command(mock_run: Mock, mock_script_dir: Path) -> None:
-    """Test confluence command routing."""
-    mock_run.return_value = 0
-
-    with patch("vds_cli.cli.SCRIPT_DIR", mock_script_dir):
-        result = runner.invoke(app, ["confluence", "content", "search", "space = TDOV"])
-        assert result.exit_code == 0
-        mock_run.assert_called_once_with("confluence", ["content", "search", "space = TDOV"], mock_script_dir)
-
-
-@patch("vds_cli.cli.run_orchestrator")
-def test_cli_bitbucket_command(mock_run: Mock, mock_script_dir: Path) -> None:
-    """Test bitbucket command routing."""
-    mock_run.return_value = 0
-
-    with patch("vds_cli.cli.SCRIPT_DIR", mock_script_dir):
-        result = runner.invoke(app, ["bitbucket", "projects"])
-        assert result.exit_code == 0
-        mock_run.assert_called_once_with("bitbucket", ["projects"], mock_script_dir)
-
-
-@patch("vds_cli.cli.load_environment")
-def test_cli_status_command(mock_load: Mock, mock_script_dir: Path) -> None:
-    """Test status command."""
-    from vds_cli.env import VDSSettings
-
-    mock_settings = VDSSettings()
-    mock_settings.bitbucket_access_token = "test_token"
-    mock_load.return_value = mock_settings
-
-    with patch("vds_cli.cli.SCRIPT_DIR", mock_script_dir):
-        result = runner.invoke(app, ["status"])
-        assert result.exit_code == 0
-        assert "Status" in result.stdout
-        assert "Orchestrator" in result.stdout or "Environment" in result.stdout
-
-
-@patch("vds_cli.cli._env_git_helper")
-@patch("vds_cli.cli.validate_orchestrator")
-@patch("vds_cli.cli.load_environment")
-def test_cli_doctor_command(
-    mock_load: Mock,
-    mock_validate: Mock,
-    mock_helper: Mock,
-    mock_env_file: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Test doctor command with healthy environment and router checks.
-
-    Mocks _env_git_helper.status() so the git-credential-helper presence check
-    passes deterministically across CI/dev machines (without this mock, doctor
-    exits 1 when the helper isn't installed in the test environment).
-    """
-    from vds_cli.env import VDSSettings
-
-    mock_settings = VDSSettings()
-    mock_settings.vds_username = "test_user"
-    mock_settings.vds_password = "test_pass"
-    mock_settings.bitbucket_access_token = "test_token"
-    mock_settings.internal_confluence_token = "test_internal"
-    mock_load.return_value = mock_settings
-    mock_validate.return_value = (True, "✅ Available")
-    mock_helper.status.return_value = ("installed", "")
-    # Use openai provider so doctor skips the live Ollama probe (which would
-    # otherwise mark the test machine as unreachable and exit non-zero).
-    monkeypatch.setenv("VDS_AGENT_CORE_EMBED__PROVIDER", "openai")
-
-    with patch("vds_cli.cli.DEFAULT_ENV_PATHS", (mock_env_file,)):
-        result = runner.invoke(app, ["doctor"])
-        assert result.exit_code == 0
-        assert "Doctor checks passed" in result.stdout
-
-

package/skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py

@@ -1,110 +0,0 @@
-"""Integration tests for DOC-004 observability CLI wiring.
-
-Covers:
-- docs onboarding-funnel command (real module integration)
-- docs onboarding-funnel JSON output
-- docs freshness command still callable (no regression)
-- Window_days parameter handling
-"""
-
-from __future__ import annotations
-
-from io import StringIO
-
-import pytest
-from rich.console import Console
-from vds_cli.cli import docs_freshness, docs_onboarding_funnel
-
-
-@pytest.fixture
-def tmp_repo_with_docs(tmp_path):
-    """Create a fake repo with a few docs in different Diátaxis quadrants."""
-    repo = tmp_path / "vds-scripts"
-    how_to = repo / "docs/agents/how-to"
-    reference = repo / "docs/agents/reference"
-    how_to.mkdir(parents=True)
-    reference.mkdir(parents=True)
-    (how_to / "run-ecosystem-daily-report.md").write_text("# How To\n")
-    (how_to / "configure-agents.md").write_text("# How To\n")
-    (reference / "skills-commands.md").write_text("# Reference\n")
-    return repo
-
-
-@pytest.fixture
-def empty_sessions_dir(tmp_path):
-    """Empty session dir (no reads)."""
-    path = tmp_path / "sessions"
-    path.mkdir()
-    return path
-
-
-class _FakeConsole:
-    """Collect anything passed to print() into a list of strings."""
-
-    def __init__(self):
-        self.lines = []
-
-    def print(self, text, *_, **__):
-        self.lines.append(str(text))
-
-
-def test_onboarding_funnel_table_runs(tmp_repo_with_docs, empty_sessions_dir, monkeypatch):
-    """docs onboarding-funnel completes without errors when sessions dir has no reads."""
-    buf = StringIO()
-    fake = Console(file=buf, width=160, no_color=True, force_terminal=True)
-    monkeypatch.setattr("vds_cli.cli.console", fake)
-
-    docs_onboarding_funnel(
-        repo_root=tmp_repo_with_docs,
-        sessions_dir=empty_sessions_dir,
-        format="table",
-        window_days=60,
-    )
-    out = buf.getvalue()
-    assert "Doc Funnel" in out
-    assert "vds-scripts" in out
-
-
-def test_onboarding_funnel_json_format(tmp_repo_with_docs, empty_sessions_dir, monkeypatch):
-    """JSON output contains expected keys for programmatic consumers."""
-    console = _FakeConsole()
-    monkeypatch.setattr("vds_cli.cli.console", console)
-
-    docs_onboarding_funnel(
-        repo_root=tmp_repo_with_docs,
-        sessions_dir=empty_sessions_dir,
-        format="json",
-        window_days=60,
-    )
-    joined = "\n".join(console.lines)
-    assert '"dead_weight"' in joined
-    assert '"stages"' in joined
-    assert str(tmp_repo_with_docs) in joined
-    assert '"total_docs": 0' in joined
-
-
-def test_onboarding_funnel_window_days_affects_dead_weight(tmp_repo_with_docs, empty_sessions_dir, monkeypatch):
-    """Dead-weight count reflects window_days (empty sessions => zero doc reads)."""
-    console = _FakeConsole()
-    monkeypatch.setattr("vds_cli.cli.console", console)
-
-    docs_onboarding_funnel(
-        repo_root=tmp_repo_with_docs,
-        sessions_dir=empty_sessions_dir,
-        format="json",
-        window_days=7,
-    )
-    joined = "\n".join(console.lines)
-    assert '"total_docs": 0' in joined
-    assert '"active_docs": 0' in joined
-    assert '"dead_weight": 0' in joined
-
-
-def test_freshness_command_importable():
-    """Ensure docs_freshness hasn't been broken by doc-004 changes."""
-    import inspect
-
-    params = inspect.signature(docs_freshness).parameters
-    assert "repo_root" in params
-    assert "repo" in params
-    assert "config" in params