@north-light/crouter 0.3.318 → 0.3.320

package/dist/commands/sys/__tests__/config-model-ladders.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/sys/__tests__/config-model-ladders.test.js

@@ -1,114 +0,0 @@
-// config-model-ladders.test.ts — regression coverage for the live Hearth
-// incident where a home's stored config had `openai-codex/gpt-5.6-*` baked into
-// `modelLadders` while the guest's own installed model registry only had
-// `gpt-5.5`. Root cause: both `ensureScopeInitialized` (fresh scope) and
-// `sys config set modelLadders...` (a targeted edit) persisted the fully
-// materialized ladder (all 4 strengths x 2 providers) rather than only the
-// genuine override, freezing whatever concrete model ids happened to be
-// compiled into the crouter build that ran at that moment. A later
-// crouter/pi upgrade (or rollback) that changes the registry can then never
-// reach the frozen rungs again.
-import { test, before, after, beforeEach, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { ensureScopeInitialized, readConfig, readRawScopeConfig, updateConfig } from '../../../core/config.js';
-import { configBranch } from '../config.js';
-function leaf(name) {
-    const found = (configBranch.children ?? []).find((c) => c.name === name);
-    if (found === undefined || found.kind !== 'leaf')
-        throw new Error(`no leaf '${name}' under sys config`);
-    return found;
-}
-let home;
-let realHome;
-before(() => {
-    realHome = process.env['HOME'];
-});
-beforeEach(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-config-ladders-'));
-    process.env['HOME'] = home;
-});
-// Every test allocates its own temp HOME in beforeEach, so each must be removed
-// in afterEach -- a single `after` would leak all but the last dir.
-afterEach(() => {
-    rmSync(home, { recursive: true, force: true });
-});
-after(() => {
-    if (realHome !== undefined)
-        process.env['HOME'] = realHome;
-    else
-        delete process.env['HOME'];
-});
-test('ensureScopeInitialized does NOT bake concrete modelLadders model ids into a fresh scoped store', () => {
-    const root = join(home, '.crouter');
-    ensureScopeInitialized('user', root);
-    const raw = readRawScopeConfig('user');
-    // A fresh store has no settings row until a caller writes an override, so
-    // `readConfig` always re-derives the ladder from the running build.
-    assert.equal(raw?.modelLadders, undefined);
-    // readConfig must still default-fill a full, usable ladder despite the
-    // omission -- a config-less scope is never worse off.
-    const cfg = readConfig('user');
-    assert.equal(typeof cfg.modelLadders.anthropic.strong, 'string');
-    assert.equal(typeof cfg.modelLadders.openai.strong, 'string');
-});
-test('sys config set modelLadders.<provider>.<strength> persists ONLY the touched rung, not the whole materialized ladder', async () => {
-    const root = join(home, '.crouter');
-    ensureScopeInitialized('user', root);
-    await leaf('set').run({ key: 'modelLadders.openai.strong', value: 'openai-codex/gpt-5.5:high' });
-    const raw = readRawScopeConfig('user');
-    assert.equal(raw.modelLadders?.openai?.strong, 'openai-codex/gpt-5.5:high');
-    // The other three openai rungs, and the entire anthropic ladder, must stay
-    // UNSET on disk -- baking them in would freeze this scope to today's
-    // compiled defaults for rungs the user never touched, the exact staleness
-    // bug that produced the live `gpt-5.6` vs. installed-`gpt-5.5` mismatch.
-    assert.equal(raw.modelLadders?.openai?.ultra, undefined);
-    assert.equal(raw.modelLadders?.openai?.medium, undefined);
-    assert.equal(raw.modelLadders?.openai?.light, undefined);
-    assert.equal(raw.modelLadders?.anthropic, undefined);
-    // readConfig still resolves a full ladder: the one override layered over
-    // live compiled defaults for everything else.
-    const cfg = readConfig('user');
-    assert.equal(cfg.modelLadders.openai.strong, 'openai-codex/gpt-5.5:high');
-    assert.equal(typeof cfg.modelLadders.openai.ultra, 'string');
-    assert.equal(typeof cfg.modelLadders.anthropic.strong, 'string');
-});
-test('an unrelated updateConfig mutation (as fresh bootstrap does) does NOT freeze modelLadders to disk', () => {
-    const root = join(home, '.crouter');
-    ensureScopeInitialized('user', root);
-    // Mimic `ensureOfficialMarketplace`'s bootstrap write: updateConfig mutating an
-    // unrelated field on a fresh scope. This must not materialize a full ladder.
-    updateConfig('user', (c) => {
-        c.marketplaces['crouter-official-marketplace'] = {
-            url: 'https://example.invalid/x.git',
-            ref: 'main',
-            installed_at: '2026-01-01T00:00:00.000Z',
-        };
-    });
-    const raw = readRawScopeConfig('user');
-    assert.equal(raw.modelLadders, undefined);
-    assert.ok(raw.marketplaces?.['crouter-official-marketplace']);
-});
-test('a non-ladder sys config set does NOT freeze modelLadders to disk', async () => {
-    const root = join(home, '.crouter');
-    ensureScopeInitialized('user', root);
-    await leaf('set').run({ key: 'max_panes_per_window', value: '5' });
-    const raw = readRawScopeConfig('user');
-    // The touched key persists; modelLadders stays absent so a later build's
-    // registry change still reaches every rung.
-    assert.equal(raw.max_panes_per_window, 5);
-    assert.equal(raw.modelLadders, undefined);
-});
-test('a second sys config set for a different rung does not clobber an earlier override', async () => {
-    const root = join(home, '.crouter');
-    ensureScopeInitialized('user', root);
-    await leaf('set').run({ key: 'modelLadders.openai.strong', value: 'openai-codex/gpt-5.5:high' });
-    await leaf('set').run({ key: 'modelLadders.anthropic.light', value: 'anthropic/claude-haiku-4-5:high' });
-    const raw = readRawScopeConfig('user');
-    assert.equal(raw.modelLadders?.openai?.strong, 'openai-codex/gpt-5.5:high');
-    assert.equal(raw.modelLadders?.anthropic?.light, 'anthropic/claude-haiku-4-5:high');
-    assert.equal(raw.modelLadders?.openai?.ultra, undefined);
-    assert.equal(raw.modelLadders?.anthropic?.strong, undefined);
-});

package/dist/commands/sys/__tests__/setup-core.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/sys/__tests__/setup-core.test.js

@@ -1,45 +0,0 @@
-// Pure boundaries behind `crtr sys setup`: which pi CLI crouter launches, how a
-// failed provider login is classified, and how a concrete model reference maps
-// back onto a portable provider/strength selection.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { existsSync } from 'node:fs';
-import { resolveBundledPiCliPath } from '../../../core/runtime/pi-cli.js';
-import { inferPortableModelSelection } from '../../../core/runtime/launch.js';
-import { defaultModelLaddersConfig } from '../../../types.js';
-import { classifyLoginFailure } from '../panels/provider-panel.js';
-test('resolveBundledPiCliPath uses crouter bundled pi instead of a standalone pi on PATH', () => {
-    const prevPath = process.env.PATH;
-    process.env.PATH = '';
-    try {
-        const cliPath = resolveBundledPiCliPath();
-        assert.equal(existsSync(cliPath), true);
-        // The path INSIDE the package is pi's own layout (0.84.4 moved it to
-        // dist/bundle/cli.js) and is read from its package.json `bin.pi` — assert
-        // only that we resolved into the bundled package.
-        assert.match(cliPath, /@earendil-works[\/]pi-coding-agent[\/].*cli\.js$/);
-    }
-    finally {
-        if (prevPath === undefined)
-            delete process.env.PATH;
-        else
-            process.env.PATH = prevPath;
-    }
-});
-test('classifyLoginFailure treats an abort as authoritative', () => {
-    assert.equal(classifyLoginFailure(new Error('anything'), true), 'Login cancelled');
-    assert.equal(classifyLoginFailure(Object.assign(new Error('x'), { name: 'AbortError' }), false), 'Login cancelled');
-    assert.equal(classifyLoginFailure(new Error('network exploded'), false), 'Login error: network exploded');
-    assert.equal(classifyLoginFailure('not an Error object', false), 'Login error: not an Error object');
-});
-test('portable kind selection preserves provider across tokens and concrete ladder refs', () => {
-    const ladders = defaultModelLaddersConfig();
-    ladders.defaultProvider = 'openai';
-    ladders.openai.strong = 'openai-codex/gpt-shared:high';
-    assert.deepEqual(inferPortableModelSelection('anthropic/strong', ladders), { provider: 'anthropic', strength: 'strong' });
-    assert.deepEqual(inferPortableModelSelection('strong', ladders), { provider: 'openai', strength: 'strong' });
-    assert.deepEqual(inferPortableModelSelection('openai-codex/gpt-shared:high', ladders), { provider: 'openai', strength: 'strong' });
-    assert.deepEqual(inferPortableModelSelection('openai-codex/gpt-shared:medium', ladders), { provider: 'openai', strength: 'strong' });
-    assert.deepEqual(inferPortableModelSelection('openai-codex/off-ladder:high', ladders), { provider: 'openai', strength: 'ultra' });
-    assert.deepEqual(inferPortableModelSelection('unknown-provider/off-ladder', ladders), { provider: 'openai', strength: 'ultra' });
-});

package/dist/commands/sys/__tests__/sync-project-guidance.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/sys/__tests__/sync-project-guidance.test.js

@@ -1,244 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import test from 'node:test';
-import { lintMemoryStore } from '../../../core/memory/lint.js';
-import { openProjectMemoryStore } from '../../../core/memory-resolver.js';
-import { insertStoredProfile } from '../../../core/scoped-state/profiles.js';
-import { initializeFreshScopedStore } from '../../../core/scoped-state/migrate.js';
-import { closeScopedStores } from '../../../core/scoped-state/db.js';
-import { resetScopeCache } from '../../../core/scope.js';
-const HERE = dirname(fileURLToPath(import.meta.url));
-const CLI = join(HERE, '../../../cli.ts');
-const TSX_LOADER = import.meta.resolve('tsx/esm');
-function write(path, content) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, content);
-}
-/** Store keys and target ids are realpaths, so the fixture must be one too:
- *  macOS hands `mkdtemp` a `/var/folders` path whose realpath is `/private/...`. */
-function fixtureHome(prefix) {
-    const home = realpathSync(mkdtempSync(join(tmpdir(), prefix)));
-    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
-    return home;
-}
-/** A home the ambient node's own CRTR_* environment cannot leak into. */
-function syncEnv(home) {
-    const env = { ...process.env, HOME: home };
-    for (const key of Object.keys(env)) {
-        if (key.startsWith('CRTR_'))
-            delete env[key];
-    }
-    env['CRTR_NO_AUTO_INIT'] = '1';
-    env['CRTR_NO_AUTO_UPDATE'] = '1';
-    return env;
-}
-function runSyncRaw(home, opts = {}) {
-    const env = syncEnv(home);
-    if (opts.profileId !== undefined)
-        env['CRTR_PROFILE_ID'] = opts.profileId;
-    return spawnSync(process.execPath, [
-        '--conditions=crtr-src',
-        '--import',
-        TSX_LOADER,
-        CLI,
-        'sys',
-        'sync',
-        'project-guidance',
-        ...(opts.source === undefined ? [] : ['--source', opts.source]),
-        '--json',
-        ...(opts.overwrite === true ? ['--overwrite'] : []),
-    ], { cwd: opts.cwd ?? home, env, encoding: 'utf8' });
-}
-function runSync(home, opts = {}) {
-    const result = runSyncRaw(home, opts);
-    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
-    return JSON.parse(result.stdout);
-}
-function initializeRepository(path) {
-    mkdirSync(path, { recursive: true });
-    const result = spawnSync('git', ['init', '--quiet', path], { encoding: 'utf8' });
-    assert.equal(result.status, 0, result.stderr);
-}
-function writeProfile(home, profileId, project) {
-    insertStoredProfile(join(home, '.crouter'), {
-        profileId,
-        manifest: {
-            schema_version: 1,
-            name: 'sync fixture',
-            projects: [{ path: realpathSync(project), memory: 'content' }],
-            home: realpathSync(project),
-            paused_at: null,
-            created_at: '2026-01-01T00:00:00.000Z',
-            last_used_at: null,
-        },
-    }, join(home, '.crouter', 'profiles', profileId));
-    resetScopeCache();
-}
-function lintFixtureStore(home, project) {
-    const previousHome = process.env['HOME'];
-    process.env['HOME'] = home;
-    resetScopeCache();
-    try {
-        return lintMemoryStore(openProjectMemoryStore(project));
-    }
-    finally {
-        closeScopedStores();
-        resetScopeCache();
-        if (previousHome === undefined)
-            delete process.env['HOME'];
-        else
-            process.env['HOME'] = previousHome;
-    }
-}
-test('sync project-guidance --overwrite preserves an authored root and still imports rules', () => {
-    const home = fixtureHome('crtr-sync-project-guidance-');
-    const project = join(home, 'my-project');
-    initializeRepository(project);
-    const authoredRoot = `---
-kind: knowledge
-namespace: my-project
-when-and-why-to-read: When working in my-project, this knowledge should be read because it holds hand-authored operating guidance.
-short-form: Hand-authored project guide, not migrated.
-surfaces:
-  - on: workspace-open
-    at: content
-  - on: read
-    match: ./**
-    at: content
----
-# My Project
-
-This is the real, hand-written operating guide. It must survive a rules-only sync.
-`;
-    write(join(project, '.crouter', 'memory', 'INDEX.md'), authoredRoot);
-    write(join(project, '.claude', 'rules', 'lint.md'), `---
-description: Lint rules
-paths: "src/**/*.ts"
----
-# Lint
-
-Run the linter before committing.
-`);
-    const before = readFileSync(join(project, '.crouter', 'memory', 'INDEX.md'), 'utf8');
-    const output = runSync(home, { source: project, overwrite: true });
-    const after = readFileSync(join(project, '.crouter', 'memory', 'INDEX.md'), 'utf8');
-    assert.equal(after, before, 'authored root must not be replaced by the synthetic placeholder');
-    const rootRow = output.results.find((r) => r.target.endsWith(join('.crouter', 'memory', 'INDEX.md')));
-    assert.equal(rootRow, undefined, 'an already-authored root must not appear as an import/skip row');
-    const ruleRow = output.results.find((r) => r.source.endsWith(join('.claude', 'rules', 'lint.md')));
-    assert.ok(ruleRow, 'the rule must still be imported');
-    assert.equal(ruleRow?.status, 'imported');
-    const ruleDoc = readFileSync(ruleRow.target, 'utf8');
-    assert.match(ruleDoc, /Run the linter before committing\./);
-});
-test('sync project-guidance writes one repository-root declaration for each repository', () => {
-    const home = fixtureHome('crtr-sync-project-guidance-');
-    const workspace = join(home, 'workspace');
-    const alpha = join(workspace, 'alpha-repository');
-    const beta = join(workspace, 'beta-repository');
-    initializeRepository(alpha);
-    initializeRepository(beta);
-    write(join(alpha, 'CLAUDE.md'), '# Alpha Repository\n');
-    write(join(beta, 'AGENTS.md'), '# Beta Repository\n');
-    const output = runSync(home, { source: workspace });
-    for (const [repository, namespace] of [[alpha, 'alpha-repository'], [beta, 'beta-repository']]) {
-        const declaration = join(repository, '.crouter', 'memory', 'INDEX.md');
-        assert.equal(existsSync(declaration), true, `the repository root owns ${namespace}'s declaration`);
-        assert.match(readFileSync(declaration, 'utf8'), new RegExp(`namespace: ${namespace}`));
-        assert.ok(output.results.some((row) => row.target === declaration && row.name === namespace));
-    }
-    assert.equal(output.results.filter((row) => row.target.endsWith(join('.crouter', 'memory', 'INDEX.md'))).length, 2);
-});
-test('sync project-guidance converts a nested guide without repository-root metadata', () => {
-    const home = fixtureHome('crtr-sync-project-guidance-');
-    const repository = join(home, 'nested-guide-repository');
-    const nested = join(repository, 'packages', 'tool');
-    initializeRepository(repository);
-    write(join(repository, 'CLAUDE.md'), '# Repository Guide\n');
-    write(join(nested, 'AGENTS.md'), `---
-surfaces:
-  - on: workspace-open
-    at: content
-  - on: read
-    match: ./**
-    at: content
-  - on: read
-    match: ./packages/tool/**/*.ts
-    at: content
----
-# Nested Guide
-
-Nested operating guidance.
-`);
-    runSync(home, { source: repository });
-    const nestedIndex = readFileSync(join(nested, '.crouter', 'memory', 'INDEX.md'), 'utf8');
-    assert.match(nestedIndex, /kind: knowledge/);
-    assert.doesNotMatch(nestedIndex, /^namespace:/m);
-    assert.doesNotMatch(nestedIndex, /^name:/m);
-    assert.doesNotMatch(nestedIndex, /on: workspace-open/);
-    assert.match(nestedIndex, /when-and-why-to-read:/);
-    assert.match(nestedIndex, /on: read/);
-    assert.match(nestedIndex, /packages\/tool\/\*\*\/\*\.ts/);
-    assert.match(nestedIndex, /Nested operating guidance\./);
-    const lint = lintFixtureStore(home, nested);
-    assert.equal(lint.ok, true, JSON.stringify(lint.findings));
-});
-test('sync project-guidance imports nested rules as leaves without a synthetic nested index', () => {
-    const home = fixtureHome('crtr-sync-project-guidance-');
-    const repository = join(home, 'nested-rules-repository');
-    const nested = join(repository, 'packages', 'tool');
-    initializeRepository(repository);
-    write(join(nested, '.claude', 'rules', 'lint.md'), `---
-description: Nested lint rules
-paths: "src/**/*.ts"
----
-# Lint
-
-Run nested linting.
-`);
-    const output = runSync(home, { source: repository });
-    const nestedStore = join(nested, '.crouter', 'memory');
-    const rule = join(nestedStore, 'lint.md');
-    assert.equal(existsSync(join(repository, '.crouter', 'memory', 'INDEX.md')), true, 'the repository declaration is synthesized');
-    assert.equal(existsSync(rule), true);
-    assert.equal(existsSync(join(nestedStore, 'INDEX.md')), false, 'rules never synthesize a nested store root');
-    assert.ok(output.results.some((row) => row.target === rule && row.name === 'nested-rules-repository/packages/tool/lint'));
-});
-test('sync project-guidance rejects a nested authored namespace at the repository declaration path', () => {
-    const home = fixtureHome('crtr-sync-project-guidance-');
-    const repository = join(home, 'namespace-rejection-repository');
-    const nestedGuide = join(repository, 'packages', 'tool', 'AGENTS.md');
-    initializeRepository(repository);
-    write(join(repository, 'CLAUDE.md'), '# Repository Guide\n');
-    write(nestedGuide, '---\nnamespace: forbidden\n---\n# Nested Guide\n');
-    const result = runSyncRaw(home, { source: repository });
-    assert.notEqual(result.status, 0);
-    assert.match(result.stdout, new RegExp(`project guidance at ${nestedGuide} declares a namespace`));
-    assert.match(result.stdout, new RegExp(`${join(repository, '.crouter', 'memory', 'INDEX.md')} is the only declaration for this repository`));
-});
-test('sync project-guidance keeps canonical names stable across cwd, profile widening, and explicit source discovery', () => {
-    const names = [];
-    for (const context of ['cwd', 'profile', 'source']) {
-        const home = fixtureHome(`crtr-sync-project-guidance-${context}-`);
-        const repository = join(home, 'canonical-repository');
-        initializeRepository(repository);
-        write(join(repository, 'CLAUDE.md'), '# Canonical Repository\n');
-        const output = context === 'cwd'
-            ? runSync(home, { cwd: repository })
-            : context === 'profile'
-                ? (() => {
-                    const profileId = 'sync-fixture-12345678';
-                    writeProfile(home, profileId, repository);
-                    return runSync(home, { profileId });
-                })()
-                : runSync(home, { source: repository });
-        const root = output.results.find((row) => row.target === join(repository, '.crouter', 'memory', 'INDEX.md'));
-        assert.ok(root, `${context} discovers the repository root guide`);
-        names.push(root.name);
-    }
-    assert.deepEqual(names, ['canonical-repository', 'canonical-repository', 'canonical-repository']);
-});

package/dist/core/__tests__/bash-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/bash-guard.test.js

@@ -1,190 +0,0 @@
-// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/bash-guard.test.ts
-//
-// BUG REGRESSION: a node ran
-//   cd star-theory-2 && HOME="$(mktemp -d …)" godot …; rm -rf "$HOME" …
-// The `HOME=` prefix applied only to `godot`, so the trailing `rm -rf "$HOME"`
-// expanded to the real home directory and deleted for ~108s before another node
-// killed it. The guard refuses that command text before bash ever sees it.
-import assert from 'node:assert/strict';
-import { homedir, userInfo } from 'node:os';
-import { test } from 'node:test';
-import { bashCommandRefusal } from '../bash-guard.js';
-const HOME = homedir();
-const CWD = `${HOME}/Code/cli/crouter`;
-function refusal(command, cwd = CWD) {
-    return bashCommandRefusal(command, cwd);
-}
-function assertRefused(command, expectedTarget, cwd = CWD) {
-    const message = refusal(command, cwd);
-    assert.notEqual(message, null, `expected refusal for: ${command}`);
-    assert.ok(message.includes(expectedTarget), `refusal for ${command} should name ${expectedTarget}, got: ${message}`);
-}
-function assertAllowed(command, cwd = CWD) {
-    assert.equal(refusal(command, cwd), null, `expected to allow: ${command}`);
-}
-// The incident
-test('the incident command is refused and names the segment and resolved target', () => {
-    const command = 'cd star-theory-2 && HOME="$(mktemp -d /tmp/st2-legend-proof.XXXXXX)" godot --headless --path . ' +
-        '--script "$CRTR_CONTEXT_DIR/legend_proof.gd"; status=$?; rm -rf "$HOME" 2>/dev/null || true; exit $status';
-    const message = refusal(command);
-    assert.notEqual(message, null);
-    assert.ok(message.includes('rm -rf "$HOME"'), `should quote the offending segment: ${message}`);
-    assert.ok(message.includes(HOME), `should name the resolved target: ${message}`);
-});
-// Home, however it is spelled
-test('every textual spelling of the home directory is refused', () => {
-    for (const target of ['~', '~/', '"$HOME"', '$HOME', '${HOME}', '"${HOME}/"', HOME, `${HOME}/`, '~/*', '"$HOME"/*']) {
-        assertRefused(`rm -rf ${target}`, HOME);
-    }
-});
-// System roots
-test('system roots are refused', () => {
-    for (const target of ['/', '/Users', '/home', '/private', '/var', '/etc', '/tmp', '/usr', '/opt', '/System', '/Library', '/Applications', '/private/var']) {
-        assertRefused(`rm -rf ${target}`, target);
-    }
-});
-test('the canvas home is refused', () => {
-    assertRefused('rm -rf ~/.crouter', `${HOME}/.crouter`);
-});
-// Ancestors of the working directory
-test('a strict ancestor of the working directory is refused', () => {
-    assertRefused(`rm -rf ${HOME}/Code/cli`, `${HOME}/Code/cli`);
-    assertRefused('rm -rf ..', `${HOME}/Code/cli`);
-});
-test('a relative target is read against every directory the line could be in', () => {
-    assertRefused('cd packages && rm -rf ../..', `${HOME}/Code/cli`);
-    // The guard cannot know a `cd` succeeded: after a failed one bash stays put,
-    // so `..` really is the ancestor and the refusal must still fire.
-    assertRefused('cd definitely-does-not-exist; rm -rf ..', `${HOME}/Code/cli`);
-    // Nowhere knowable to resolve from, so nothing relative is refused.
-    assertAllowed('cd "$SOMEWHERE" && rm -rf ..');
-    assertRefused('cd "$SOMEWHERE" && rm -rf ~', HOME);
-});
-test('the working directory itself still removes — a node may delete its own merged worktree', () => {
-    const worktree = `${HOME}/.crouter/canvas/worktrees/node-1`;
-    assertAllowed('rm -rf .', worktree);
-    assertAllowed(`rm -rf ${worktree}`, worktree);
-});
-// Recursive flag spellings
-test('every recursive flag spelling is refused', () => {
-    for (const flags of ['-rf', '-fr', '-r', '-R', '-Rf', '-rvf', '--recursive -f', '-f --recursive', '-f -r', '-r --', '-rf --']) {
-        assertRefused(`rm ${flags} ~`, HOME);
-    }
-});
-test('a non-recursive rm is not this guard\u2019s business', () => {
-    assertAllowed('rm ~');
-    assertAllowed('rm -f ~/.zshrc');
-});
-// Prefixes that hide the verb
-test('a command prefix does not hide the rm', () => {
-    for (const prefix of ['sudo', 'sudo -E', 'command', 'nice -n 10', 'nohup', 'time', 'env', 'doas']) {
-        assertRefused(`${prefix} rm -rf ~`, HOME);
-    }
-});
-test('a leading VAR=value assignment does not hide the rm', () => {
-    assertRefused('FOO=bar rm -rf ~', HOME);
-});
-// The distinction the incident turned on: an `export` changes $HOME for the
-// rest of the line, a `HOME=… cmd` PREFIX changes it for that one command.
-test('a reassigned HOME is honoured for the rest of the line', () => {
-    assertAllowed('export HOME=/tmp/st2home_5e && rm -rf "$HOME"');
-    assertAllowed('export HOME=/tmp/st2home_5e\nfind "$HOME" -name settings.cfg -delete');
-    assertAllowed('cd star-theory-2 && export HOME=/tmp/x && rm -rf "$HOME" && mkdir -p "$HOME"');
-    assertAllowed('HOME=/tmp/x\nrm -rf ~');
-    // Reassigned to something the guard cannot read: unknowable, so allowed.
-    assertAllowed('export HOME="$(mktemp -d)"; rm -rf "$HOME"');
-});
-test('a HOME= prefix on one command does not carry to the next', () => {
-    assertRefused('HOME=/tmp/x godot --headless; rm -rf "$HOME"', HOME);
-});
-test('a HOME= prefix does apply to its own command', () => {
-    assertAllowed('HOME=/tmp/x rm -rf "$HOME"');
-});
-test('a backgrounded assignment runs in a subshell and does not carry', () => {
-    assertRefused('HOME=/tmp/x & rm -rf "$HOME"', HOME);
-    assertRefused('export HOME=/tmp/x & rm -rf "$HOME"', HOME);
-    assertAllowed('export HOME=/tmp/x && rm -rf "$HOME"');
-});
-test('an assignment to a builtin that exports it persists', () => {
-    assertAllowed('HOME=/tmp/x export HOME; rm -rf "$HOME"');
-});
-test('$USER and $LOGNAME expand — a per-user path spelled that way still resolves', () => {
-    // Anchored on the working directory rather than the home path, whose per-user
-    // segment is not the username on every platform this runs on.
-    const user = userInfo().username;
-    const parent = `/srv/people/${user}`;
-    assertRefused('rm -rf /srv/people/$USER', parent, `${parent}/project`);
-    assertRefused('rm -rf "/srv/people/${LOGNAME}"', parent, `${parent}/project`);
-});
-test('a redirection is not a target', () => {
-    assertAllowed('rm -rf ./dist 2>/dev/null');
-    assertAllowed('rm -rf ./dist > /dev/null 2>&1');
-    assertRefused('rm -rf ~ 2>/dev/null', HOME);
-});
-// Segment separators
-test('the rm is found in any shell segment', () => {
-    for (const command of ['ls && rm -rf ~', 'ls; rm -rf ~', 'ls || rm -rf ~', 'ls | rm -rf ~', 'ls &\nrm -rf ~']) {
-        assertRefused(command, HOME);
-    }
-});
-// Must still run
-test('ordinary removals still run', () => {
-    assertAllowed('rm -rf "$d"');
-    assertAllowed('rm -rf node_modules');
-    assertAllowed('rm -rf /tmp/foo.XXXX');
-    assertAllowed('rm -rf "$CRTR_CONTEXT_DIR/jobs/x"');
-    assertAllowed('rm -rf ~/Code/cli/crouter/dist');
-    assertAllowed('rm -rf ./dist .dist-build-*');
-    assertAllowed('rm -rf "$HOME/.cache/crouter/termrender"');
-    assertAllowed('rm -rf ~/.crouter/canvas/scratch/old');
-    assertAllowed('rm -rf /tmp/crtr-build.1234');
-});
-test('a quoted mention of a dangerous command is data, not a command', () => {
-    assertAllowed('echo "rm -rf ~"');
-    assertAllowed("git commit -m 'never rm -rf $HOME'");
-});
-test('a heredoc body is data, not a command', () => {
-    assertAllowed('cat > note.md <<\'EOF\'\nrm -rf ~\nEOF');
-});
-// Other operations that can destroy a home or system tree
-test('moving a protected path away is refused', () => {
-    assertRefused('mv ~ /tmp/old-home', HOME);
-    assertRefused('mv /etc /tmp/etc', '/etc');
-});
-test('a recursive permission or ownership change on a protected path is refused', () => {
-    assertRefused('chmod -R 777 /', '/');
-    assertRefused('sudo chown -R root ~', HOME);
-    assertRefused('chgrp -R staff /usr', '/usr');
-    assertAllowed('chmod -R 755 ./scripts');
-    assertAllowed('chmod 600 ~/.ssh/config');
-});
-test('a find that deletes or executes over a protected path is refused', () => {
-    assertRefused('find ~ -name "*.log" -delete', HOME);
-    assertRefused('find / -name core -exec rm -f {} \\;', '/');
-    assertAllowed('find ~ -name "*.log"');
-    assertAllowed('find . -name "*.log" -delete');
-});
-test('find’s leading global options do not hide its start path', () => {
-    assertRefused('find -H ~ -delete', HOME);
-    assertRefused('find -- ~ -delete', HOME);
-    assertRefused('find -L -x /etc -delete', '/etc');
-    assertRefused('find -f ~ -delete', HOME);
-    assertAllowed('find -H ./logs -delete');
-});
-test('writing a raw disk or reformatting one is refused', () => {
-    assertRefused('dd if=/dev/zero of=/dev/disk0 bs=1m', '/dev/disk0');
-    assertRefused('dd if=/dev/zero of=/dev/rdisk3 bs=1m', '/dev/rdisk3');
-    assertRefused('sudo mkfs.ext4 /dev/sda1', 'mkfs.ext4');
-    assertRefused('diskutil eraseDisk JHFS+ Blank /dev/disk2', 'diskutil eraseDisk');
-    assertAllowed('dd if=/dev/zero of=./blob bs=1m count=1');
-    // A character device is ordinary output, not a disk.
-    assertAllowed('dd if=/dev/zero of=/dev/null bs=1m count=1');
-    assertAllowed('dd if=./blob of=/dev/stdout');
-});
-// The long-sleep refusal moved here with the rest of the bash refusals.
-test('a long leading sleep is still refused, a short one still runs', () => {
-    assert.notEqual(refusal('sleep 300'), null);
-    assert.notEqual(refusal('sleep 5m'), null);
-    assert.equal(refusal('sleep 5'), null);
-    assert.equal(refusal('sleep "$n"'), null);
-});

package/dist/core/__tests__/boot-fault-attempt.test.d.ts

@@ -1 +0,0 @@
-export {};