@openparachute/agent 0.1.2 → 0.2.2

package/src/secrets/secrets.test.ts

@@ -1,651 +0,0 @@
-import crypto from 'crypto';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import type { SecretMode } from '../types.js';
-import { closeDb, initTestDb, runMigrations } from '../db/index.js';
-import { _setMasterKeyForTest } from './master-key.js';
-import {
-  addAssignment,
-  deleteSecret,
-  findStaleSessionsForSecret,
-  getSecret,
-  getSecretById,
-  listAssignments,
-  listInjectableSecretsForGroup,
-  listSecrets,
-  putSecret,
-  removeAssignment,
-  replaceAssignments,
-  resolveInjectableSecrets,
-} from './index.js';
-
-beforeEach(() => {
-  const db = initTestDb();
-  runMigrations(db);
-  _setMasterKeyForTest(crypto.randomBytes(32));
-});
-
-afterEach(() => {
-  closeDb();
-});
-
-function seedAgentGroup(db: ReturnType<typeof initTestDb>, id: string, mode: SecretMode = 'selective') {
-  db.prepare(
-    `INSERT INTO agent_groups (id, folder, name, secret_mode, created_at)
-     VALUES (?, ?, ?, ?, datetime('now'))`,
-  ).run(id, id, id, mode);
-}
-
-describe('secrets store', () => {
-  it('round-trips a global secret', () => {
-    putSecret('SLACK_BOT_TOKEN', 'xoxb-1234');
-    expect(getSecret('SLACK_BOT_TOKEN')).toBe('xoxb-1234');
-  });
-
-  it('returns undefined for missing names', () => {
-    expect(getSecret('NOT_THERE')).toBeUndefined();
-  });
-
-  it('updates an existing secret in place', () => {
-    const id1 = putSecret('NAME', 'v1');
-    const id2 = putSecret('NAME', 'v2');
-    expect(id1).toBe(id2);
-    expect(getSecret('NAME')).toBe('v2');
-  });
-
-  it('lists secret metadata without exposing values', () => {
-    putSecret('A', 'aaa');
-    putSecret('B', 'bbb', { kind: 'channel-token' });
-    const rows = listSecrets();
-    expect(rows.map((r) => r.name).sort()).toEqual(['A', 'B']);
-    expect(rows.find((r) => r.name === 'B')?.kind).toBe('channel-token');
-    expect(rows[0]).not.toHaveProperty('value_encrypted');
-  });
-
-  it('agent-scoped secret beats a global one with the same name', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'g1');
-
-    putSecret('TOKEN', 'global-value');
-    putSecret('TOKEN', 'g1-value', { agent_group_id: 'g1' });
-
-    expect(getSecret('TOKEN')).toBe('global-value');
-    expect(getSecret('TOKEN', 'g1')).toBe('g1-value');
-  });
-
-  it('falls back to global when no scoped row exists', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'g1');
-
-    putSecret('SHARED', 'global-only');
-    expect(getSecret('SHARED', 'g1')).toBe('global-only');
-  });
-
-  it('deletes by id', () => {
-    const id = putSecret('ZAP', 'value');
-    expect(deleteSecret(id)).toBe(true);
-    expect(getSecret('ZAP')).toBeUndefined();
-    expect(deleteSecret(id)).toBe(false);
-  });
-
-  it('resolveInjectableSecrets in mode=all unions global + scoped, scoped wins', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'g1', 'all');
-
-    putSecret('G', 'global-only');
-    putSecret('S', 'scoped-only', { agent_group_id: 'g1' });
-    putSecret('B', 'global-B', {});
-    putSecret('B', 'scoped-B', { agent_group_id: 'g1' });
-
-    const env = resolveInjectableSecrets('g1');
-    expect(env.get('G')).toBe('global-only');
-    expect(env.get('S')).toBe('scoped-only');
-    expect(env.get('B')).toBe('scoped-B');
-  });
-
-  it('mode=selective hides unassigned globals, but scoped secrets are auto-seeded into the owner', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'g1', 'selective');
-
-    // Unassigned global → invisible under selective mode.
-    putSecret('GLOBAL', 'global-v');
-    // Scoped secret → putSecret auto-seeds the (id, g1) assignment row, so
-    // the resolver injects it even under selective mode (paraclaw#127).
-    putSecret('SCOPED', 'scoped-v', { agent_group_id: 'g1' });
-
-    const env = resolveInjectableSecrets('g1');
-    expect([...env.keys()]).toEqual(['SCOPED']);
-    expect(env.get('SCOPED')).toBe('scoped-v');
-  });
-
-  it('unknown agent_group_id resolves as no-secrets (selective default)', () => {
-    putSecret('GLOBAL', 'v');
-    expect(resolveInjectableSecrets('does-not-exist').size).toBe(0);
-  });
-});
-
-describe('putSecret auto-seeds the owner assignment for scoped creates (paraclaw#127)', () => {
-  /**
-   * The default `agent_groups.secret_mode` is `selective` (migration 023).
-   * Before the auto-seed, calling `putSecret(name, value, { agent_group_id })`
-   * inserted a `secrets` row but never the matching `secret_assignments` row,
-   * leaving the secret silently invisible to `resolveInjectableSecrets` —
-   * the row predicate `(s.agent_group_id = g.id OR s.agent_group_id IS NULL)`
-   * matches but the gate `(g.secret_mode='all' OR a.secret_id IS NOT NULL)`
-   * rejects. UI layers had a follow-up `setSecretAssignments` that papered
-   * over this on edits, but the create-side `CredentialForm` "free" mode
-   * called only `putSecret` — so the standard "+ New secret" flow produced
-   * orphan rows.
-   *
-   * Fix: `putSecret` writes the (id, owning_group) assignment row in the
-   * same transaction on INSERT. UPDATE/rotate leaves the assignment set
-   * alone (operator may have deliberately revoked).
-   */
-
-  it('scoped create writes a matching secret_assignments row', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    const id = putSecret('TOKEN', 'v', { agent_group_id: 'A' });
-
-    expect(listAssignments(id)).toEqual(['A']);
-  });
-
-  it('scoped create in selective mode is visible via resolveInjectableSecrets without an explicit assign call', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    putSecret('TOKEN', 'scoped-v', { agent_group_id: 'A' });
-
-    expect(resolveInjectableSecrets('A').get('TOKEN')).toBe('scoped-v');
-  });
-
-  it('scoped create in selective mode is visible via listInjectableSecretsForGroup, tagged scope=scoped', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    putSecret('TOKEN', 'scoped-v', { agent_group_id: 'A' });
-
-    const rows = listInjectableSecretsForGroup('A');
-    expect(rows).toHaveLength(1);
-    expect(rows[0].name).toBe('TOKEN');
-    expect(rows[0].scope).toBe('scoped');
-  });
-
-  it('global create does NOT write any secret_assignments row', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-
-    const id = putSecret('GLOBAL_TOKEN', 'v');
-
-    expect(listAssignments(id)).toEqual([]);
-    const total = db.prepare<{ n: number }>(`SELECT COUNT(*) AS n FROM secret_assignments`).get();
-    expect(total?.n).toBe(0);
-  });
-
-  it('rotate (UPDATE path) does NOT touch the assignment set', () => {
-    // Operator may have deliberately revoked the auto-seeded assignment —
-    // a rotate must not re-seed it. The auto-seed is INSERT-only.
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    const id = putSecret('TOKEN', 'v1', { agent_group_id: 'A' });
-    expect(listAssignments(id)).toEqual(['A']);
-
-    // Operator revokes.
-    removeAssignment(id, 'A');
-    expect(listAssignments(id)).toEqual([]);
-
-    // Rotate plaintext — assignment set stays empty.
-    const id2 = putSecret('TOKEN', 'v2', { agent_group_id: 'A' });
-    expect(id2).toBe(id);
-    expect(listAssignments(id)).toEqual([]);
-  });
-
-  it('two scoped creates with different owners each seed their own row', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-    seedAgentGroup(db, 'B', 'selective');
-
-    const aId = putSecret('TOKEN', 'va', { agent_group_id: 'A' });
-    const bId = putSecret('TOKEN', 'vb', { agent_group_id: 'B' });
-
-    expect(aId).not.toBe(bId);
-    expect(listAssignments(aId)).toEqual(['A']);
-    expect(listAssignments(bId)).toEqual(['B']);
-    // Each scoped create is visible only in its own group, never across.
-    expect(resolveInjectableSecrets('A').get('TOKEN')).toBe('va');
-    expect(resolveInjectableSecrets('B').get('TOKEN')).toBe('vb');
-  });
-});
-
-describe('secret assignments (selective mode)', () => {
-  it('round-trips: assignment to A injects into A, not B', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-    seedAgentGroup(db, 'B', 'selective');
-
-    const secretId = putSecret('SHARED_KEY', 'top-secret');
-    addAssignment(secretId, 'A');
-
-    expect(resolveInjectableSecrets('A').get('SHARED_KEY')).toBe('top-secret');
-    expect(resolveInjectableSecrets('B').has('SHARED_KEY')).toBe(false);
-  });
-
-  it('list/replace/add/remove cycle', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A');
-    seedAgentGroup(db, 'B');
-    seedAgentGroup(db, 'C');
-
-    const id = putSecret('K', 'v');
-    expect(listAssignments(id)).toEqual([]);
-
-    replaceAssignments(id, ['A', 'B']);
-    expect(listAssignments(id)).toEqual(['A', 'B']);
-
-    addAssignment(id, 'C');
-    expect(listAssignments(id)).toEqual(['A', 'B', 'C']);
-
-    // re-add is a no-op (composite PK)
-    expect(addAssignment(id, 'C')).toBe(false);
-
-    removeAssignment(id, 'A');
-    expect(listAssignments(id)).toEqual(['B', 'C']);
-
-    replaceAssignments(id, []);
-    expect(listAssignments(id)).toEqual([]);
-  });
-
-  it('replaceAssignments throws on unknown secret', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    expect(() => replaceAssignments('does-not-exist', [])).toThrow(/secret not found/);
-  });
-
-  it('deleting a secret cascades its assignments', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A');
-
-    const id = putSecret('K', 'v');
-    addAssignment(id, 'A');
-    expect(listAssignments(id)).toEqual(['A']);
-
-    deleteSecret(id);
-
-    const remaining = db.prepare<{ n: number }>(`SELECT COUNT(*) AS n FROM secret_assignments`).get();
-    expect(remaining?.n).toBe(0);
-  });
-
-  it('selective group + assignment + scoped secret in mode=all peer group', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-    seedAgentGroup(db, 'B', 'all');
-
-    // Global with explicit assignment to A only — A sees it via assignment,
-    // B sees its own scoped row instead (scoped wins on name collision).
-    const globalId = putSecret('TOKEN', 'shared-via-allowlist');
-    addAssignment(globalId, 'A');
-    putSecret('TOKEN', 'b-only', { agent_group_id: 'B' });
-
-    expect(resolveInjectableSecrets('A').get('TOKEN')).toBe('shared-via-allowlist');
-    expect(resolveInjectableSecrets('B').get('TOKEN')).toBe('b-only');
-  });
-});
-
-describe('findStaleSessionsForSecret', () => {
-  function seedSession(
-    db: ReturnType<typeof initTestDb>,
-    sessionId: string,
-    agentGroupId: string,
-    createdAt: string,
-    containerStatus: 'running' | 'idle' | 'stopped' = 'running',
-  ) {
-    db.prepare(
-      `INSERT INTO sessions
-         (id, agent_group_id, messaging_group_id, thread_id, agent_provider, status, container_status, last_active, created_at)
-       VALUES (?, ?, NULL, NULL, NULL, 'active', ?, NULL, ?)`,
-    ).run(sessionId, agentGroupId, containerStatus, createdAt);
-  }
-
-  function bumpSecretUpdatedAt(db: ReturnType<typeof initTestDb>, secretId: string, updatedAt: string) {
-    db.prepare(`UPDATE secrets SET updated_at = ? WHERE id = ?`).run(updatedAt, secretId);
-  }
-
-  it('returns sessions spawned before a global secret was updated, when assigned', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    // Session created at t=10
-    seedSession(db, 'sess-A', 'A', '2026-01-01T00:00:10.000Z');
-
-    // Global secret with assignment to A; secret updated at t=20 (after spawn)
-    const sid = putSecret('TOKEN', 'v');
-    addAssignment(sid, 'A');
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:20.000Z');
-
-    const stale = findStaleSessionsForSecret(sid);
-    expect(stale).toHaveLength(1);
-    expect(stale[0].sessionId).toBe('sess-A');
-    expect(stale[0].agentGroupId).toBe('A');
-    expect(stale[0].secretUpdatedAt).toBe('2026-01-01T00:00:20.000Z');
-    expect(stale[0].sessionCreatedAt).toBe('2026-01-01T00:00:10.000Z');
-  });
-
-  it('skips sessions spawned AFTER the secret update', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    const sid = putSecret('TOKEN', 'v');
-    addAssignment(sid, 'A');
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:10.000Z');
-
-    // Session spawned at t=20 — after the secret update — already has env.
-    seedSession(db, 'sess-A', 'A', '2026-01-01T00:00:20.000Z');
-
-    expect(findStaleSessionsForSecret(sid)).toEqual([]);
-  });
-
-  it('skips non-running sessions (idle and stopped)', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    const sid = putSecret('TOKEN', 'v');
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:20.000Z');
-
-    seedSession(db, 'sess-running', 'A', '2026-01-01T00:00:10.000Z', 'running');
-    seedSession(db, 'sess-idle', 'A', '2026-01-01T00:00:10.000Z', 'idle');
-    seedSession(db, 'sess-stopped', 'A', '2026-01-01T00:00:10.000Z', 'stopped');
-
-    const stale = findStaleSessionsForSecret(sid);
-    expect(stale.map((s) => s.sessionId)).toEqual(['sess-running']);
-  });
-
-  it('skips groups that would not inject the global (selective + no assignment)', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-    seedAgentGroup(db, 'B', 'selective');
-
-    const sid = putSecret('TOKEN', 'v');
-    addAssignment(sid, 'A'); // only A is assigned
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:20.000Z');
-
-    seedSession(db, 'sess-A', 'A', '2026-01-01T00:00:10.000Z');
-    seedSession(db, 'sess-B', 'B', '2026-01-01T00:00:10.000Z');
-
-    const stale = findStaleSessionsForSecret(sid);
-    expect(stale.map((s) => s.sessionId)).toEqual(['sess-A']);
-  });
-
-  it('includes mode=all groups even without an explicit assignment', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    const sid = putSecret('TOKEN', 'v');
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:20.000Z');
-
-    seedSession(db, 'sess-A', 'A', '2026-01-01T00:00:10.000Z');
-    expect(findStaleSessionsForSecret(sid).map((s) => s.sessionId)).toEqual(['sess-A']);
-  });
-
-  it('scoped secret only marks its own group stale', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-    seedAgentGroup(db, 'B', 'all');
-
-    const sid = putSecret('TOKEN', 'v', { agent_group_id: 'A' });
-    bumpSecretUpdatedAt(db, sid, '2026-01-01T00:00:20.000Z');
-
-    seedSession(db, 'sess-A', 'A', '2026-01-01T00:00:10.000Z');
-    seedSession(db, 'sess-B', 'B', '2026-01-01T00:00:10.000Z');
-
-    expect(findStaleSessionsForSecret(sid).map((s) => s.sessionId)).toEqual(['sess-A']);
-  });
-
-  it('returns [] for a missing secret id', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    expect(findStaleSessionsForSecret('does-not-exist')).toEqual([]);
-  });
-});
-
-describe('getSecretById', () => {
-  it('returns the metadata row, never the value', () => {
-    const id = putSecret('NAME', 'plaintext');
-    const row = getSecretById(id);
-    expect(row?.id).toBe(id);
-    expect(row?.name).toBe('NAME');
-    expect(row).not.toHaveProperty('value_encrypted');
-  });
-
-  it('returns undefined for a missing id', () => {
-    expect(getSecretById('does-not-exist')).toBeUndefined();
-  });
-});
-
-describe('listInjectableSecretsForGroup', () => {
-  it('tags scoped, assigned, and global rows correctly', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    // Three inclusion paths:
-    //   SCOPED   — owned by group A
-    //   ASSIGNED — global, with explicit assignment row → A
-    //   GLOBAL   — global, included only because A is mode='all'
-    const scopedId = putSecret('SCOPED_TOKEN', 'v', { agent_group_id: 'A' });
-    const assignedId = putSecret('ASSIGNED_TOKEN', 'v');
-    addAssignment(assignedId, 'A');
-    const globalId = putSecret('GLOBAL_TOKEN', 'v');
-
-    const rows = listInjectableSecretsForGroup('A');
-    const byName = new Map(rows.map((r) => [r.name, r]));
-
-    expect(byName.get('SCOPED_TOKEN')?.scope).toBe('scoped');
-    expect(byName.get('SCOPED_TOKEN')?.id).toBe(scopedId);
-    expect(byName.get('ASSIGNED_TOKEN')?.scope).toBe('assigned');
-    expect(byName.get('ASSIGNED_TOKEN')?.id).toBe(assignedId);
-    expect(byName.get('GLOBAL_TOKEN')?.scope).toBe('global');
-    expect(byName.get('GLOBAL_TOKEN')?.id).toBe(globalId);
-  });
-
-  it('selective mode hides globals that have no assignment row', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'selective');
-
-    putSecret('UNREACHABLE_GLOBAL', 'v');
-    const assignedId = putSecret('ASSIGNED', 'v');
-    addAssignment(assignedId, 'A');
-
-    const rows = listInjectableSecretsForGroup('A');
-    expect(rows.map((r) => r.name).sort()).toEqual(['ASSIGNED']);
-    expect(rows[0].scope).toBe('assigned');
-  });
-
-  it('assignment row + mode=all → assigned wins (more specific wins)', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    const id = putSecret('SHARED', 'v');
-    addAssignment(id, 'A');
-
-    const rows = listInjectableSecretsForGroup('A');
-    expect(rows).toHaveLength(1);
-    expect(rows[0].scope).toBe('assigned');
-  });
-
-  it('on name collision, scoped row wins and reports scope=scoped', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    putSecret('TOKEN', 'global-v');
-    putSecret('TOKEN', 'scoped-v', { agent_group_id: 'A' });
-
-    const rows = listInjectableSecretsForGroup('A');
-    expect(rows).toHaveLength(1);
-    expect(rows[0].name).toBe('TOKEN');
-    expect(rows[0].scope).toBe('scoped');
-  });
-
-  it('returns an empty list for an unknown agent group', () => {
-    putSecret('GLOBAL', 'v');
-    expect(listInjectableSecretsForGroup('does-not-exist')).toEqual([]);
-  });
-
-  it('never carries the encrypted value', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-    putSecret('K', 'super-secret');
-    const rows = listInjectableSecretsForGroup('A');
-    expect(rows[0]).not.toHaveProperty('value_encrypted');
-  });
-});
-
-describe('resolveInjectableSecrets ↔ listInjectableSecretsForGroup lockstep (paraclaw#129)', () => {
-  /**
-   * Mechanical guard against drift between the two SQL-identical functions in
-   * src/secrets/index.ts. Both walk identical row predicates + gate clauses;
-   * any future SQL edit must touch both. Today the invariant is preserved by
-   * careful reading + a load-bearing doc-comment. This block tests it.
-   *
-   * For each fixture, calls both functions and asserts:
-   *   - same set of names (the row gate matches)
-   *   - per-name plaintext from resolveInjectableSecrets matches the value
-   *     getSecret returns when scoped to the same group (the dedup-by-name
-   *     `ORDER BY s.agent_group_id IS NULL` scoped-wins ordering matches)
-   *
-   * If a future SQL change makes one function accept a row the other rejects,
-   * the name-set assertion fails. If the ORDER BY drifts so dedup picks the
-   * wrong row on collision, the per-name plaintext assertion fails.
-   */
-  function expectLockstep(agentGroupId: string, expectedNames: string[]): void {
-    const resolved = resolveInjectableSecrets(agentGroupId);
-    const listed = listInjectableSecretsForGroup(agentGroupId);
-
-    const sortedExpected = expectedNames.slice().sort();
-    expect([...resolved.keys()].sort()).toEqual(sortedExpected);
-    expect(listed.map((r) => r.name).sort()).toEqual(sortedExpected);
-
-    for (const view of listed) {
-      expect(resolved.get(view.name)).toBe(getSecret(view.name, agentGroupId));
-    }
-  }
-
-  it('rich mix: scoped+all + global+assigned + global+mode=all + name collision', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'A', 'all');
-
-    putSecret('SCOPED_ONLY', 'sv', { agent_group_id: 'A' });
-    const assignedId = putSecret('GLOBAL_ASSIGNED', 'gv-assigned');
-    addAssignment(assignedId, 'A');
-    putSecret('GLOBAL_MODE_ALL', 'gv-mode-all');
-    putSecret('TOKEN', 'global-token');
-    putSecret('TOKEN', 'scoped-token', { agent_group_id: 'A' });
-
-    expectLockstep('A', ['SCOPED_ONLY', 'GLOBAL_ASSIGNED', 'GLOBAL_MODE_ALL', 'TOKEN']);
-
-    // Spot-check the collision picked the scoped row in BOTH views.
-    expect(resolveInjectableSecrets('A').get('TOKEN')).toBe('scoped-token');
-    expect(listInjectableSecretsForGroup('A').find((r) => r.name === 'TOKEN')?.scope).toBe('scoped');
-  });
-
-  it('mode=selective: mixed reachable + unreachable globals + scoped-with-assignment', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'B', 'selective');
-
-    putSecret('UNREACHABLE_GLOBAL', 'gv'); // mode=selective + no assignment → excluded
-    const reachableId = putSecret('REACHABLE', 'gv2');
-    addAssignment(reachableId, 'B');
-    const scopedAssignedId = putSecret('SCOPED_AND_ASSIGNED', 'sv', { agent_group_id: 'B' });
-    addAssignment(scopedAssignedId, 'B');
-
-    expectLockstep('B', ['REACHABLE', 'SCOPED_AND_ASSIGNED']);
-  });
-
-  it('orphaned-scoped (selective + scoped + no assignment): both exclude', () => {
-    // The "structurally unreachable via putSecret" config — selective mode +
-    // scoped secret + no assignment row. paraclaw#127 closed the create path
-    // (putSecret auto-seeds the matching assignment), so to exercise the
-    // shared gate `(g.secret_mode='all' OR a.secret_id IS NOT NULL)` we
-    // construct the orphan directly. If a future SQL change makes one of the
-    // two functions accept it, this catches the drift.
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'C', 'selective');
-
-    db.prepare(
-      `INSERT INTO secrets (id, name, value_encrypted, kind, agent_group_id, created_at, updated_at)
-         VALUES ('orphan-id', 'ORPHAN', 'ct', 'generic', 'C', datetime('now'), datetime('now'))`,
-    ).run();
-
-    expectLockstep('C', []);
-  });
-
-  it('unknown agent_group_id: both return empty (selective default)', () => {
-    putSecret('GLOBAL', 'v');
-    expectLockstep('does-not-exist', []);
-  });
-
-  it('empty secret store + mode=all: both return empty', () => {
-    const db = initTestDb();
-    runMigrations(db);
-    _setMasterKeyForTest(crypto.randomBytes(32));
-    seedAgentGroup(db, 'D', 'all');
-    expectLockstep('D', []);
-  });
-});