@openlife/cli 1.7.3

package/dist/test_integration_http_trigger_live.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+ * INT-03 + INT-04 — Live integration test against HTTP gateway.
+ *
+ * Boots a real Gateway on port 4099, hits /api/v1/trigger and admin endpoints
+ * with Basic Auth, asserts shape. Shuts down gracefully.
+ *
+ * NOT included in test:all. Run via: npm run test:integration-http
+ */
+const dotenv = __importStar(require("dotenv"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const http = __importStar(require("http"));
+const Gateway_1 = require("./orchestrator/Gateway");
+dotenv.config();
+const PORT = 4099;
+const TRIGGER_LOG = path.join(process.cwd(), 'docs', 'audit', 'integrations', 'http-trigger.log');
+const ADMIN_LOG = path.join(process.cwd(), 'docs', 'audit', 'integrations', 'admin.log');
+function log(file, line) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, `${new Date().toISOString()} ${line}\n`);
+}
+function request(method, path, headers, body) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({
+            host: '127.0.0.1', port: PORT, method, path,
+            headers: { ...headers, ...(body ? { 'Content-Length': Buffer.byteLength(body).toString() } : {}) }
+        }, (res) => {
+            let buf = '';
+            res.on('data', (d) => { buf += d.toString(); });
+            res.on('end', () => resolve({ status: res.statusCode || 0, headers: res.headers, body: buf }));
+        });
+        req.on('error', reject);
+        req.setTimeout(10000, () => req.destroy(new Error('REQUEST_TIMEOUT')));
+        if (body)
+            req.write(body);
+        req.end();
+    });
+}
+async function main() {
+    // Force credentials for this test (do not leak real ones to test code)
+    process.env.PORT = String(PORT);
+    process.env.OPENLIFE_TRIGGER_USER = 'audit-trigger';
+    process.env.OPENLIFE_TRIGGER_PASS = 'audit-pass-' + process.pid;
+    process.env.OPENLIFE_ADMIN_USER = 'audit-admin';
+    process.env.OPENLIFE_ADMIN_PASS = 'audit-adminpass-' + process.pid;
+    const triggerAuth = 'Basic ' + Buffer.from(`audit-trigger:${process.env.OPENLIFE_TRIGGER_PASS}`).toString('base64');
+    const adminAuth = 'Basic ' + Buffer.from(`audit-admin:${process.env.OPENLIFE_ADMIN_PASS}`).toString('base64');
+    const gateway = new Gateway_1.Gateway();
+    gateway.start();
+    // Give Express + Telegraf launch a beat
+    await new Promise((r) => setTimeout(r, 2000));
+    const failures = [];
+    try {
+        // INT-03: /api/v1/trigger
+        log(TRIGGER_LOG, '----- INT-03 /api/v1/trigger -----');
+        // 3a: no auth → 401
+        const r1 = await request('POST', '/api/v1/trigger', { 'Content-Type': 'application/json' }, JSON.stringify({ text: 'audit ping' }));
+        log(TRIGGER_LOG, `no-auth status=${r1.status} body=${r1.body.slice(0, 100)}`);
+        if (r1.status !== 401)
+            failures.push(`trigger no-auth expected 401 got ${r1.status}`);
+        // 3b: wrong pass → 403
+        const wrongAuth = 'Basic ' + Buffer.from('audit-trigger:wrong').toString('base64');
+        const r2 = await request('POST', '/api/v1/trigger', { 'Content-Type': 'application/json', 'Authorization': wrongAuth }, JSON.stringify({ text: 'audit ping' }));
+        log(TRIGGER_LOG, `wrong-pass status=${r2.status} body=${r2.body.slice(0, 100)}`);
+        if (r2.status !== 403)
+            failures.push(`trigger wrong-pass expected 403 got ${r2.status}`);
+        // 3c: valid auth → 200
+        const r3 = await request('POST', '/api/v1/trigger', { 'Content-Type': 'application/json', 'Authorization': triggerAuth }, JSON.stringify({ text: 'audit ping via INT-03' }));
+        log(TRIGGER_LOG, `valid-auth status=${r3.status} body=${r3.body.slice(0, 200)}`);
+        if (r3.status !== 200 && r3.status !== 202 && r3.status !== 500) {
+            failures.push(`trigger valid-auth expected 200/202/500 got ${r3.status}`);
+        }
+        // 500 is acceptable: Brain may fail downstream when running without full env
+        // INT-04: admin endpoints
+        log(ADMIN_LOG, '----- INT-04 admin endpoints -----');
+        const adminEndpoints = ['/api/v1/admin/teams', '/api/v1/admin/networks', '/api/v1/admin/status'];
+        for (const ep of adminEndpoints) {
+            // no auth → 401
+            const ra = await request('GET', ep, {});
+            log(ADMIN_LOG, `${ep} no-auth status=${ra.status}`);
+            if (ra.status !== 401)
+                failures.push(`${ep} no-auth expected 401 got ${ra.status}`);
+            // valid auth → 200
+            const rb = await request('GET', ep, { 'Authorization': adminAuth });
+            let parsed;
+            try {
+                parsed = JSON.parse(rb.body);
+            }
+            catch {
+                parsed = null;
+            }
+            const ok = rb.status === 200 && parsed && typeof parsed === 'object';
+            log(ADMIN_LOG, `${ep} valid-auth status=${rb.status} json_ok=${!!parsed} preview=${rb.body.slice(0, 120)}`);
+            if (!ok)
+                failures.push(`${ep} valid-auth expected 200+JSON got status=${rb.status} parsed=${!!parsed}`);
+        }
+    }
+    finally {
+        try {
+            await gateway.shutdown('TEST_DONE');
+        }
+        catch (e) {
+            log(TRIGGER_LOG, `shutdown_error: ${e?.message || e}`);
+        }
+        delete process.env.OPENLIFE_TRIGGER_PASS;
+        delete process.env.OPENLIFE_ADMIN_PASS;
+    }
+    if (failures.length > 0) {
+        throw new Error(`HTTP_INTEGRATION_FAILURES (${failures.length}):\n${failures.join('\n')}`);
+    }
+    console.log(`TEST_INTEGRATION_HTTP_TRIGGER_LIVE_OK (trigger=3 cases, admin=${adminEndpoints_count()} endpoints × 2 auth states)`);
+    console.log(`  trigger log: ${TRIGGER_LOG}`);
+    console.log(`  admin log:   ${ADMIN_LOG}`);
+}
+function adminEndpoints_count() { return 3; }
+main().catch((err) => {
+    console.error('TEST_INTEGRATION_HTTP_TRIGGER_LIVE_FAIL:', err?.message || err);
+    process.exit(1);
+});

package/dist/test_integration_telegram_live.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+ * INT-02 — Live integration test against Telegram Bot API.
+ *
+ * SIDE EFFECT: sends one real message to the allowlisted chat_id.
+ * The message will appear in Rafael's Telegram chat with the bot.
+ *
+ * Requires TELEGRAM_BOT_TOKEN + OPENLIFE_TELEGRAM_ALLOWED_USER_ID in .env.
+ *
+ * NOT included in test:all. Run via: npm run test:integration-telegram
+ */
+const dotenv = __importStar(require("dotenv"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const telegraf_1 = require("telegraf");
+dotenv.config();
+const LOG_PATH = path.join(process.cwd(), 'docs', 'audit', 'integrations', 'telegram.log');
+function logLine(line) {
+    fs.mkdirSync(path.dirname(LOG_PATH), { recursive: true });
+    fs.appendFileSync(LOG_PATH, `${new Date().toISOString()} ${line}\n`);
+}
+async function main() {
+    const token = process.env.TELEGRAM_BOT_TOKEN;
+    const chatId = process.env.OPENLIFE_TELEGRAM_ALLOWED_USER_ID;
+    if (!token || !chatId) {
+        throw new Error(`MISSING_CREDS: token=${!!token} chatId=${!!chatId}`);
+    }
+    logLine(`START telegram live test (chat_id=${chatId})`);
+    const bot = new telegraf_1.Telegraf(token);
+    // Verify bot identity (read-only, no message sent)
+    let botInfo;
+    try {
+        botInfo = await bot.telegram.getMe();
+        logLine(`bot_info username=@${botInfo.username} id=${botInfo.id} is_bot=${botInfo.is_bot}`);
+    }
+    catch (err) {
+        logLine(`FAIL getMe error=${err?.message || err}`);
+        throw new Error(`TELEGRAM_GETME_FAILED: ${err?.message || err}`);
+    }
+    // Send real message
+    const messageText = `🤖 AUDIT-OK from Phase 4 INT-02 — Total Feature Audit milestone — ${new Date().toISOString()}`;
+    let sentMsg;
+    const t0 = Date.now();
+    try {
+        sentMsg = await bot.telegram.sendMessage(chatId, messageText);
+        const elapsed = Date.now() - t0;
+        logLine(`OK message_id=${sentMsg.message_id} elapsed=${elapsed}ms`);
+        console.log(`TEST_INTEGRATION_TELEGRAM_LIVE_OK (bot=@${botInfo.username}, message_id=${sentMsg.message_id}, elapsed=${elapsed}ms)`);
+        console.log(`  log: ${LOG_PATH}`);
+        console.log(`  message: ${messageText.slice(0, 80)}...`);
+    }
+    catch (err) {
+        logLine(`FAIL sendMessage error=${err?.message || err}`);
+        throw new Error(`TELEGRAM_SEND_FAILED: ${err?.message || err}`);
+    }
+    // Telegraf has no pending handle to close in this path (we never started polling),
+    // so the process should exit cleanly. Add safety net just in case.
+    setTimeout(() => process.exit(0), 100).unref();
+}
+main().catch((err) => {
+    const msg = err?.message || String(err);
+    try {
+        logLine(`FAIL ${msg.slice(0, 300)}`);
+    }
+    catch { }
+    console.error('TEST_INTEGRATION_TELEGRAM_LIVE_FAIL:', msg);
+    process.exit(1);
+});

package/dist/test_job_lifecycle.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const JobLifecycle_1 = require("./orchestrator/JobLifecycle");
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(message);
+}
+const store = new JobLifecycle_1.JobLifecycleStore('testws');
+const job = store.enqueue('test objective', 'testws');
+store.transition(job.jobId, 'testws', 'claimed', 'claimed', 'agent-a');
+store.transition(job.jobId, 'testws', 'started', 'started', 'agent-a');
+store.transition(job.jobId, 'testws', 'completed', 'done', 'agent-a');
+const rec = store.get(job.jobId);
+assert(rec?.status === 'completed', 'job should be completed');
+assert(store.events(job.jobId).length >= 4, 'job should have lifecycle events');
+console.log('TEST_JOB_LIFECYCLE_OK');

package/dist/test_memory_orchestrator.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const MemoryOrchestrator_1 = require("./memory/MemoryOrchestrator");
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(message);
+}
+async function main() {
+    const orchestrator = new MemoryOrchestrator_1.MemoryOrchestrator();
+    await orchestrator.save({
+        type: 'semantic',
+        namespace: { project: 'open-life-core', user: 'rafa' },
+        content: 'Runtime policy agora usa health e cooldown para fallback.',
+        summary: 'runtime policy com health e cooldown',
+        tags: ['runtime', 'phase1'],
+        confidence: 0.9,
+        dedupeKey: 'phase1-runtime-health',
+        providers: ['local']
+    });
+    const results = await orchestrator.search({
+        query: 'runtime policy health cooldown',
+        namespace: { project: 'open-life-core' },
+        topK: 5
+    }, ['local']);
+    assert(results.length >= 1, 'should retrieve at least one memory result');
+    assert(results[0].record.namespace.project === 'open-life-core', 'should preserve namespace');
+    assert(results[0].provider === 'local', 'should expose provider origin');
+    console.log('TEST_MEMORY_ORCHESTRATOR_OK');
+}
+main().catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+});

package/dist/test_memory_promotion.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const PromotionPipeline_1 = require("./orchestrator/PromotionPipeline");
+const MemoryPromotionFlow_1 = require("./memory/MemoryPromotionFlow");
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(message);
+}
+async function main() {
+    const pipeline = new PromotionPipeline_1.PromotionPipeline();
+    const flow = new MemoryPromotionFlow_1.MemoryPromotionFlow();
+    pipeline.add({
+        id: 'playbook-runtime-fallback',
+        type: 'playbook',
+        sourceMissionId: 'mission-123',
+        summary: 'Quando Gemini cair por quota, priorizar cooldown e fallback para Codex.',
+        createdAt: new Date().toISOString()
+    }, {
+        project: 'open-life-core',
+        user: 'rafa',
+        domain: 'runtime',
+        missionType: 'runtime'
+    });
+    const results = await flow.retrieve('Gemini quota fallback codex', {
+        project: 'open-life-core',
+        user: 'rafa',
+        domain: 'runtime'
+    }, ['semantic', 'episodic']);
+    assert(results.length >= 1, 'should retrieve promoted memory');
+    assert(results.some((item) => item.record.namespace.project === 'open-life-core'), 'promoted memory should preserve namespace');
+    console.log('TEST_MEMORY_PROMOTION_OK');
+}
+main().catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+});

package/dist/test_memory_retention.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const MemoryRetentionPolicy_1 = require("./memory/MemoryRetentionPolicy");
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(message);
+}
+function makeRecord(type, createdAt, confidence = 0.8) {
+    return {
+        id: `${type}-${createdAt}`,
+        type,
+        namespace: { project: 'open-life-core' },
+        content: 'runtime fallback policy with cooldown and codex recovery',
+        summary: 'runtime fallback policy',
+        tags: ['runtime', 'fallback'],
+        confidence,
+        createdAt,
+        updatedAt: createdAt
+    };
+}
+async function main() {
+    const retention = new MemoryRetentionPolicy_1.MemoryRetentionPolicy();
+    const oldWorking = makeRecord('working', new Date(Date.now() - 10 * 24 * 60 * 60 * 1000).toISOString());
+    const recentSemantic = makeRecord('semantic', new Date().toISOString(), 0.9);
+    const profile = makeRecord('profile', new Date(Date.now() - 120 * 24 * 60 * 60 * 1000).toISOString(), 0.7);
+    assert(retention.decide(oldWorking).keep === false, 'old working memory should expire');
+    assert(retention.decide(recentSemantic).keep === true, 'recent semantic memory should be kept');
+    assert(retention.decide(profile).keep === true, 'profile memory should persist');
+    const recentScore = retention.score(recentSemantic, 'runtime fallback codex');
+    const oldScore = retention.score(oldWorking, 'runtime fallback codex');
+    assert(recentScore > oldScore, 'recent semantic memory should outrank stale working memory');
+    console.log('TEST_MEMORY_RETENTION_OK');
+}
+main().catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+});

package/dist/test_mission_checkpoint.js

@@ -0,0 +1,204 @@
+"use strict";
+/**
+ * test_mission_checkpoint — Story 6.2 regression suite.
+ *
+ * Asserts the MissionCheckpointStore contract:
+ *   1. Save + read round-trip; getLatest returns null before any save
+ *   2. Resume semantics: resumeFromCheckpoint returns latest, list/clear
+ *   3. Save overwrites previous checkpoint (latest wins); sanitization
+ *      protects against directory traversal in missionId
+ *
+ * Path resolution honors OPENLIFE_STATE_DIR (so the test can sandbox in a
+ * temp dir without touching the real `.openlife/`).
+ *
+ * Run via: `npm run test:mission-checkpoint`. Prints
+ * TEST_MISSION_CHECKPOINT_OK on full pass.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const MissionState_1 = require("./orchestrator/MissionState");
+function assert(cond, msg) {
+    if (!cond)
+        throw new Error(`assertion failed: ${msg}`);
+}
+function mkTmp() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'mission-ckpt-test-'));
+}
+function rmTmp(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch { /* ignore */ }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 1: save + getLatest round-trip
+// ─────────────────────────────────────────────────────────────
+function scenarioRoundTrip() {
+    const tmpRoot = mkTmp();
+    const prev = process.env.OPENLIFE_STATE_DIR;
+    try {
+        process.env.OPENLIFE_STATE_DIR = path.join(tmpRoot, '.openlife');
+        const store = new MissionState_1.MissionCheckpointStore();
+        // Pre-condition: no checkpoint exists
+        assert(store.getLatestCheckpoint('mission-001') === null, 'must return null before any save');
+        assert(store.list().length === 0, 'list must be empty initially');
+        // Save a checkpoint
+        const state = { workflowRunId: 'run-abc', completedSteps: ['s1', 's2'], pendingSteps: ['s3'] };
+        store.saveCheckpoint('mission-001', 'step-3', state);
+        // Read back
+        const ckpt = store.getLatestCheckpoint('mission-001');
+        assert(ckpt !== null, 'getLatest must return saved checkpoint');
+        const c = ckpt;
+        assert(c.missionId === 'mission-001', 'missionId mismatch');
+        assert(c.step === 'step-3', 'step mismatch');
+        assert(JSON.stringify(c.state) === JSON.stringify(state), 'state round-trip mismatch');
+        assert(typeof c.savedAt === 'string' && c.savedAt.length > 0, 'savedAt must be a non-empty ISO string');
+        // File should live under <state>/checkpoints/
+        const baseDir = store._baseDir();
+        assert(baseDir.startsWith(process.env.OPENLIFE_STATE_DIR), 'baseDir must respect OPENLIFE_STATE_DIR');
+        assert(fs.existsSync(path.join(baseDir, 'mission-001.json')), 'checkpoint file must exist on disk');
+        // List must report the missionId
+        const list = store.list();
+        assert(list.length === 1 && list[0] === 'mission-001', `list mismatch: ${JSON.stringify(list)}`);
+        console.log('✅ scenario 1: save + getLatest round-trip');
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.OPENLIFE_STATE_DIR;
+        else
+            process.env.OPENLIFE_STATE_DIR = prev;
+        rmTmp(tmpRoot);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 2: resume semantics + clear
+// ─────────────────────────────────────────────────────────────
+function scenarioResumeAndClear() {
+    const tmpRoot = mkTmp();
+    const prev = process.env.OPENLIFE_STATE_DIR;
+    try {
+        process.env.OPENLIFE_STATE_DIR = path.join(tmpRoot, '.openlife');
+        const store = new MissionState_1.MissionCheckpointStore();
+        store.saveCheckpoint('m-a', 'step-1', { foo: 'a' });
+        store.saveCheckpoint('m-b', 'step-1', { foo: 'b' });
+        store.saveCheckpoint('m-c', 'step-2', { foo: 'c' });
+        const list = store.list().sort();
+        assert(list.length === 3, `expected 3 missions with checkpoints, got ${list.length}`);
+        assert(JSON.stringify(list) === JSON.stringify(['m-a', 'm-b', 'm-c']), `list contents: ${JSON.stringify(list)}`);
+        // resumeFromCheckpoint should return the same as getLatest
+        const resumeB = store.resumeFromCheckpoint('m-b');
+        const getB = store.getLatestCheckpoint('m-b');
+        assert(resumeB !== null && getB !== null, 'both must return non-null');
+        assert(JSON.stringify(resumeB) === JSON.stringify(getB), 'resume and getLatest must return identical data');
+        // Clear m-b
+        store.clear('m-b');
+        assert(store.getLatestCheckpoint('m-b') === null, 'after clear, getLatest must return null');
+        assert(store.list().length === 2, 'list must shrink after clear');
+        // Clearing a non-existent missionId is a no-op (no throw)
+        store.clear('does-not-exist');
+        console.log('✅ scenario 2: resume semantics + clear');
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.OPENLIFE_STATE_DIR;
+        else
+            process.env.OPENLIFE_STATE_DIR = prev;
+        rmTmp(tmpRoot);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 3: overwrite + missionId sanitization
+// ─────────────────────────────────────────────────────────────
+function scenarioOverwriteAndSanitize() {
+    const tmpRoot = mkTmp();
+    const prev = process.env.OPENLIFE_STATE_DIR;
+    try {
+        process.env.OPENLIFE_STATE_DIR = path.join(tmpRoot, '.openlife');
+        const store = new MissionState_1.MissionCheckpointStore();
+        // Overwrite: saving twice keeps only the latest
+        store.saveCheckpoint('m-x', 'step-1', { value: 'first' });
+        const firstSavedAt = store.getLatestCheckpoint('m-x')?.savedAt;
+        // Ensure measurable time gap before overwrite (ISO timestamps are ms precision)
+        const deadline = Date.now() + 5;
+        while (Date.now() < deadline) { /* spin briefly */ }
+        store.saveCheckpoint('m-x', 'step-2', { value: 'second' });
+        const after = store.getLatestCheckpoint('m-x');
+        assert(after !== null, 'overwritten checkpoint must still be readable');
+        assert(after.step === 'step-2', `latest step must be 'step-2', got '${after.step}'`);
+        assert(after.state.value === 'second', 'latest state must reflect overwrite');
+        assert(after.savedAt !== firstSavedAt, 'savedAt must change after overwrite');
+        // List should still report m-x exactly once
+        assert(store.list().filter((m) => m === 'm-x').length === 1, 'list must not duplicate after overwrite');
+        // Sanitization: missionIds with path traversal attempts must be neutralized
+        const sneaky = '../../../etc/passwd';
+        store.saveCheckpoint(sneaky, 'step-1', { value: 'blocked' });
+        const baseDir = store._baseDir();
+        // The sanitized file must live INSIDE baseDir, never outside it
+        const dangerousPath = path.join(baseDir, '..', '..', '..', 'etc', 'passwd.json');
+        assert(!fs.existsSync(dangerousPath), 'sanitization must prevent path traversal');
+        // And the checkpoint must still be retrievable using the original (un-sanitized) missionId
+        const sneakyCkpt = store.getLatestCheckpoint(sneaky);
+        assert(sneakyCkpt !== null, 'sanitized checkpoint must round-trip with the original missionId key');
+        console.log('✅ scenario 3: overwrite + sanitization');
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.OPENLIFE_STATE_DIR;
+        else
+            process.env.OPENLIFE_STATE_DIR = prev;
+        rmTmp(tmpRoot);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Driver
+// ─────────────────────────────────────────────────────────────
+function main() {
+    console.log('🧪 test_mission_checkpoint — Story 6.2 regression suite');
+    scenarioRoundTrip();
+    scenarioResumeAndClear();
+    scenarioOverwriteAndSanitize();
+    console.log('');
+    console.log('TEST_MISSION_CHECKPOINT_OK');
+}
+try {
+    main();
+}
+catch (err) {
+    console.error('❌ test_mission_checkpoint FAILED:', err instanceof Error ? err.message : err);
+    process.exit(1);
+}