@pikku/core 0.12.106 → 0.12.111

package/src/wirings/channel/channel-rpc.test.ts

@@ -1,841 +0,0 @@
-import { describe, test } from 'node:test'
-import * as assert from 'node:assert/strict'
-
-import { pikkuState } from '../../pikku-state.js'
-
-import {
-  CHANNEL_RPC_PENDING,
-  CHANNEL_RPC_REQUEST,
-  CHANNEL_RPC_RESPONSE,
-  ChannelDeploymentService,
-  ChannelRPCRegistry,
-  createChannelRPCResponder,
-  isChannelRPCRequest,
-  isChannelRPCResponse,
-  createChannelRPCInputValidator,
-  createChannelRPCResultValidator,
-  unsupportedChannelRemote,
-  type ChannelRPCError,
-  type ChannelRPCRequest,
-  type ChannelRPCResponse,
-  type ChannelRPCValidator,
-} from './channel-rpc.js'
-
-/**
- * Wires a "server" ChannelDeploymentService to a "client" responder so the
- * pair round-trips in-process, standing in for the two ends of a socket.
- */
-const connect = (
-  capabilities: Record<string, (data: any) => any>,
-  timeoutMs?: number,
-  validateResult?: ChannelRPCValidator,
-  validateInput?: ChannelRPCValidator
-) => {
-  const clientSent: unknown[] = []
-  const serverSent: unknown[] = []
-
-  // These tests are about the transport, so their capabilities are declared
-  // safe rather than left unclassified — an unclassified one is refused before
-  // it reaches any of the machinery under test here.
-  const classified = Object.fromEntries(
-    Object.entries(capabilities).map(([name, execute]) => [
-      name,
-      { execute, needsApproval: false },
-    ])
-  )
-
-  const respond = createChannelRPCResponder({
-    capabilities: classified,
-    send: async (data) => {
-      clientSent.push(data)
-      service.handleResponse(data)
-    },
-  })
-
-  const service = new ChannelDeploymentService(
-    async (data) => {
-      serverSent.push(data)
-      await respond(data)
-    },
-    { timeoutMs, validateResult, validateInput }
-  )
-
-  return { service, clientSent, serverSent }
-}
-
-describe('ChannelRPCRegistry', () => {
-  test('settles the call matching a response id', async () => {
-    const registry = new ChannelRPCRegistry()
-    const a = registry.register()
-    const b = registry.register()
-
-    assert.equal(registry.inFlight, 2)
-
-    registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id: b.id,
-      ok: true,
-      result: 'b-result',
-    })
-
-    assert.equal(await b.promise, 'b-result')
-    assert.equal(registry.inFlight, 1, 'the other call stays in flight')
-
-    registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id: a.id,
-      ok: true,
-      result: 'a-result',
-    })
-    assert.equal(await a.promise, 'a-result')
-  })
-
-  test('rejects with the remote error rather than resolving undefined', async () => {
-    const registry = new ChannelRPCRegistry()
-    const call = registry.register()
-
-    registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id: call.id,
-      ok: false,
-      error: { name: 'NotFoundError', message: 'no such branch' },
-    })
-
-    await assert.rejects(call.promise, (e: ChannelRPCError) => {
-      assert.equal(e.name, 'NotFoundError')
-      assert.equal(e.message, 'no such branch')
-      assert.equal(e.reason, 'remote')
-      return true
-    })
-  })
-
-  /**
-   * The registry unrefs its timeout timer so an in-flight call can never hold
-   * a process open. That makes the timeout unawaitable in a test: when the
-   * pending call is the only thing left, the loop drains before the timer
-   * fires, and node:test cancels the file — taking every later test with it.
-   *
-   * Driving the clock by hand removes the dependency on real time entirely.
-   * `t.mock.timers` is scoped to the test and resets itself, so the tests that
-   * do want a real clock are unaffected.
-   *
-   * knowledge: decisions/internals/an-unref-d-timer-cannot-be-awaited-under-node-test.md
-   */
-  test('times out instead of hanging forever', async (t) => {
-    t.mock.timers.enable({ apis: ['setTimeout'] })
-
-    const registry = new ChannelRPCRegistry(10)
-    const call = registry.register()
-
-    const rejected = assert.rejects(call.promise, (e: ChannelRPCError) => {
-      assert.equal(e.reason, 'timeout')
-      return true
-    })
-    t.mock.timers.tick(10)
-    await rejected
-
-    assert.equal(registry.inFlight, 0, 'a timed out call is not leaked')
-  })
-
-  test('drops a late response for an already-timed-out call', async (t) => {
-    t.mock.timers.enable({ apis: ['setTimeout'] })
-
-    const registry = new ChannelRPCRegistry(10)
-    const call = registry.register()
-    const rejected = assert.rejects(call.promise)
-    t.mock.timers.tick(10)
-    await rejected
-
-    const settled = registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id: call.id,
-      ok: true,
-      result: 'too late',
-    })
-    assert.equal(settled, false)
-  })
-
-  test('hold stops the clock while a human is being asked', async () => {
-    const registry = new ChannelRPCRegistry(10)
-    const call = registry.register()
-
-    assert.equal(registry.hold(call.id), true)
-
-    // Comfortably past the timeout the call was registered with. Without the
-    // hold this is the point at which a prompt still on someone's screen has
-    // already failed the command.
-    await new Promise((r) => setTimeout(r, 40))
-    assert.equal(registry.inFlight, 1, 'the call is still waiting')
-
-    registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id: call.id,
-      ok: true,
-      result: 'approved and done',
-    })
-    assert.equal(await call.promise, 'approved and done')
-  })
-
-  test('a held call still fails the moment the socket drops', async () => {
-    const registry = new ChannelRPCRegistry(10)
-    const call = registry.register()
-    registry.hold(call.id)
-
-    // Holding removes the timer, so this is the only thing left that can fail
-    // the call — and it is the one that matches reality, because a peer that
-    // dies mid-prompt takes the connection with it.
-    registry.rejectAll('socket closed')
-
-    await assert.rejects(call.promise, (e: ChannelRPCError) => {
-      assert.equal(e.reason, 'closed')
-      return true
-    })
-  })
-
-  test('hold is ignored for an unknown or already-held call', async () => {
-    const registry = new ChannelRPCRegistry()
-    const call = registry.register()
-
-    assert.equal(registry.hold('does-not-exist'), false)
-    assert.equal(registry.hold(call.id), true)
-    assert.equal(registry.hold(call.id), false, 'holding twice changes nothing')
-
-    registry.rejectAll()
-    await assert.rejects(call.promise)
-  })
-
-  test('rejects every in-flight call when the channel drops', async () => {
-    const registry = new ChannelRPCRegistry()
-    const a = registry.register()
-    const b = registry.register()
-
-    registry.rejectAll('socket closed')
-
-    for (const call of [a, b]) {
-      await assert.rejects(call.promise, (e: ChannelRPCError) => {
-        assert.equal(e.reason, 'closed')
-        return true
-      })
-    }
-    assert.equal(registry.inFlight, 0)
-  })
-
-  test('refuses to register a call on a closed registry', async () => {
-    const registry = new ChannelRPCRegistry()
-    registry.rejectAll()
-    await assert.rejects(registry.register().promise, (e: ChannelRPCError) => {
-      assert.equal(e.reason, 'closed')
-      return true
-    })
-  })
-})
-
-describe('ChannelDeploymentService', () => {
-  test('init and start are no-ops — the socket is already open', async () => {
-    const { service } = connect({})
-
-    // Both exist only to satisfy `DeploymentService`. A deployed unit has to
-    // be brought up; a connection that is already carrying the command has
-    // nothing to bring up, and anything that calls these generically must not
-    // fail against it.
-    await service.init()
-    await service.start()
-  })
-
-  test('round-trips a call to a peer capability', async () => {
-    const { service, serverSent } = connect({
-      gitHead: async () => ({ sha: 'abc123' }),
-    })
-
-    const result = await service.invoke(
-      'gitHead',
-      { cwd: '.' },
-      { userId: 'u1' },
-      'trace-1'
-    )
-
-    assert.deepEqual(result, { sha: 'abc123' })
-
-    const request = serverSent[0] as ChannelRPCRequest
-    assert.ok(isChannelRPCRequest(request))
-    assert.equal(request.funcName, 'gitHead')
-    assert.deepEqual(request.data, { cwd: '.' })
-    assert.equal(request.traceId, 'trace-1', 'traceId propagates')
-    // The peer runs the capability as itself, on its own machine, under its
-    // own identity. Sending the caller's session would hand it credentials it
-    // has no use for and that authorise nothing on its side.
-    assert.equal(
-      'session' in (request as Record<string, unknown>),
-      false,
-      'the caller session is not put on the wire'
-    )
-  })
-
-  test('keeps concurrent calls distinct', async () => {
-    const { service } = connect({
-      echo: async ({ value }: { value: string }) => {
-        await new Promise((r) => setTimeout(r, value === 'slow' ? 20 : 1))
-        return value
-      },
-    })
-
-    const [slow, fast] = await Promise.all([
-      service.invoke('echo', { value: 'slow' }),
-      service.invoke('echo', { value: 'fast' }),
-    ])
-
-    assert.equal(slow, 'slow')
-    assert.equal(fast, 'fast')
-  })
-
-  test('surfaces a thrown peer error to the caller', async () => {
-    const { service } = connect({
-      gitHead: () => {
-        throw new Error('not a git repository')
-      },
-    })
-
-    await assert.rejects(service.invoke('gitHead', {}), (e: Error) => {
-      assert.match(e.message, /not a git repository/)
-      return true
-    })
-  })
-
-  test('refuses a capability the peer did not expose', async () => {
-    const { service } = connect({ gitHead: () => 'ok' })
-
-    await assert.rejects(
-      service.invoke('readFile', { path: '/etc/passwd' }),
-      (e: Error) => {
-        assert.equal(e.name, 'RPCNotFoundError')
-        assert.match(e.message, /Capability not exposed: readFile/)
-        return true
-      }
-    )
-  })
-
-  test('a failed send does not leave a call nobody is waiting on', async () => {
-    const service = new ChannelDeploymentService(() => {
-      throw new Error('socket is closed')
-    })
-
-    await assert.rejects(service.invoke('gitHead', {}), (e: Error) => {
-      assert.match(e.message, /socket is closed/)
-      return true
-    })
-
-    // The call is registered before the request goes out. If the send fails
-    // and the entry stays, its timeout fires later against a promise nothing
-    // holds — which Node reports as an unhandled rejection, from a call the
-    // caller already saw fail.
-    assert.equal(
-      (service as unknown as { registry: { inFlight: number } }).registry
-        .inFlight,
-      0,
-      'the failed call is retired rather than left to time out'
-    )
-  })
-
-  test('a call on a stopped service does not reach the wire', async () => {
-    const sent: unknown[] = []
-    const service = new ChannelDeploymentService((data) => {
-      sent.push(data)
-    })
-    await service.stop()
-
-    await assert.rejects(
-      service.invoke('gitHead', {}),
-      (e: ChannelRPCError) => {
-        assert.equal(e.reason, 'closed')
-        return true
-      }
-    )
-    assert.deepEqual(sent, [], 'nothing is written to a channel already gone')
-  })
-
-  test('stop() fails in-flight calls', async () => {
-    const pendingForever = new ChannelDeploymentService(() => {})
-    const call = pendingForever.invoke('gitHead', {})
-    await pendingForever.stop()
-    await assert.rejects(call, (e: ChannelRPCError) => {
-      assert.equal(e.reason, 'closed')
-      return true
-    })
-  })
-})
-
-describe('unsupportedChannelRemote', () => {
-  test('refuses immediately rather than waiting for an answer that cannot come', async () => {
-    await assert.rejects(
-      unsupportedChannelRemote('localCheckout'),
-      (e: ChannelRPCError) => {
-        assert.equal(e.reason, 'unsupported')
-        assert.match(e.message, /localCheckout/)
-        return true
-      }
-    )
-  })
-})
-
-describe('createChannelRPCResponder', () => {
-  test('ignores frames that are not RPC requests', async () => {
-    const sent: unknown[] = []
-    const respond = createChannelRPCResponder({
-      capabilities: {},
-      send: (d) => void sent.push(d),
-    })
-
-    assert.equal(
-      await respond({ action: 'cli-control', event: 'complete' }),
-      false
-    )
-    assert.equal(await respond('some rendered line'), false)
-    assert.equal(sent.length, 0, 'non-RPC frames are left for the renderer')
-  })
-
-  test('an unclassified capability is not run without approval', async () => {
-    const sent: ChannelRPCResponse[] = []
-    let ran = false
-    // No approver: there is nobody to ask. A bare function carries no policy,
-    // which resolves to needing one — the annotation nobody wrote is the one
-    // most likely to matter, so it fails closed.
-    const respond = createChannelRPCResponder({
-      capabilities: {
-        localPush: () => {
-          ran = true
-          return 'pushed'
-        },
-      },
-      send: (d) => void sent.push(d as ChannelRPCResponse),
-    })
-
-    await respond({
-      action: CHANNEL_RPC_REQUEST,
-      id: '1',
-      funcName: 'localPush',
-      data: {},
-    })
-
-    assert.equal(ran, false, 'the capability must not have run')
-    assert.equal(sent[0]?.ok, false)
-    assert.equal(sent[0]?.error?.name, 'RPCNotApprovedError')
-  })
-
-  test('a capability classified safe runs without asking', async () => {
-    const sent: ChannelRPCResponse[] = []
-    const respond = createChannelRPCResponder({
-      capabilities: {
-        gitHead: { execute: () => ({ sha: 'abc' }), needsApproval: false },
-      },
-      send: (d) => void sent.push(d as ChannelRPCResponse),
-    })
-
-    await respond({
-      action: CHANNEL_RPC_REQUEST,
-      id: '1',
-      funcName: 'gitHead',
-      data: {},
-    })
-
-    assert.equal(sent.length, 1, 'nothing was asked, so nothing was held')
-    assert.equal(sent[0]?.ok, true)
-    assert.deepEqual(sent[0]?.result, { sha: 'abc' })
-  })
-
-  test('an approved call holds the caller clock, then runs', async () => {
-    const sent: unknown[] = []
-    const asked: unknown[] = []
-    const respond = createChannelRPCResponder({
-      capabilities: {
-        localPush: {
-          execute: () => 'pushed',
-          needsApproval: true,
-          approvalDescriptionFn: ({ tag }: any) => `push tag ${tag} to origin`,
-        },
-      },
-      send: (d) => void sent.push(d),
-      approve: (request) => {
-        asked.push(request)
-        return true
-      },
-    })
-
-    await respond({
-      action: CHANNEL_RPC_REQUEST,
-      id: '1',
-      funcName: 'localPush',
-      data: { tag: 'v2.1.0' },
-    })
-
-    // The hold has to go out before the human is asked. Sent afterwards it
-    // races the caller's timeout, and an answer past the timeout is dropped —
-    // the decision would be taken and then silently thrown away.
-    assert.deepEqual(sent[0], {
-      action: CHANNEL_RPC_PENDING,
-      id: '1',
-      reason: 'push tag v2.1.0 to origin',
-    })
-    assert.deepEqual(asked, [
-      {
-        funcName: 'localPush',
-        data: { tag: 'v2.1.0' },
-        description: 'push tag v2.1.0 to origin',
-      },
-    ])
-    assert.equal((sent[1] as ChannelRPCResponse).result, 'pushed')
-  })
-
-  test('a refusal is an answer, not a hang', async () => {
-    const sent: unknown[] = []
-    let ran = false
-    const respond = createChannelRPCResponder({
-      capabilities: {
-        localPush: {
-          execute: () => {
-            ran = true
-            return 'pushed'
-          },
-          needsApproval: true,
-        },
-      },
-      send: (d) => void sent.push(d),
-      approve: () => false,
-    })
-
-    await respond({
-      action: CHANNEL_RPC_REQUEST,
-      id: '1',
-      funcName: 'localPush',
-      data: {},
-    })
-
-    assert.equal(ran, false)
-    const response = sent[sent.length - 1] as ChannelRPCResponse
-    assert.equal(response.ok, false)
-    assert.equal(response.error?.name, 'RPCDeniedError')
-  })
-
-  test('a name inherited from Object.prototype is not a capability', async () => {
-    const sent: ChannelRPCResponse[] = []
-    const respond = createChannelRPCResponder({
-      capabilities: { gitHead: () => 'ok' },
-      send: (d) => void sent.push(d as ChannelRPCResponse),
-    })
-
-    // The map is an object, so `capabilities['toString']` resolves a real
-    // function. Calling it would run code on the peer's machine under a name
-    // the peer never listed — the map is the authorisation boundary, and
-    // reaching past it through the prototype chain has to refuse like any
-    // other unknown name.
-    for (const funcName of ['toString', 'valueOf', 'constructor']) {
-      await respond({
-        action: CHANNEL_RPC_REQUEST,
-        id: funcName,
-        funcName,
-        data: {},
-      })
-    }
-
-    assert.equal(sent.length, 3)
-    for (const response of sent) {
-      assert.equal(response.ok, false)
-      assert.equal(response.error?.name, 'RPCNotFoundError')
-    }
-  })
-})
-
-describe('envelope validation', () => {
-  test('a request is only accepted with a usable id and funcName', () => {
-    const valid = {
-      action: CHANNEL_RPC_REQUEST,
-      id: '1',
-      funcName: 'gitHead',
-      data: {},
-    }
-    assert.equal(isChannelRPCRequest(valid), true)
-    assert.equal(isChannelRPCRequest({ ...valid, traceId: 'trace-1' }), true)
-
-    // Every one of these is tagged as an RPC request and would previously have
-    // passed, reaching a capability lookup with a name of the wrong type.
-    for (const frame of [
-      { ...valid, id: 1 },
-      { ...valid, id: '' },
-      { ...valid, id: undefined },
-      { ...valid, funcName: {} },
-      { ...valid, funcName: '' },
-      { ...valid, funcName: undefined },
-      { ...valid, traceId: 42 },
-      { action: CHANNEL_RPC_REQUEST },
-    ]) {
-      assert.equal(
-        isChannelRPCRequest(frame),
-        false,
-        `expected rejection of ${JSON.stringify(frame)}`
-      )
-    }
-  })
-
-  test('a response is only accepted with a usable id and ok flag', () => {
-    const valid = { action: CHANNEL_RPC_RESPONSE, id: '1', ok: true }
-    assert.equal(isChannelRPCResponse(valid), true)
-
-    for (const frame of [
-      { ...valid, id: 7 },
-      { ...valid, id: '' },
-      { ...valid, ok: 'yes' },
-      { ...valid, ok: undefined },
-      { action: CHANNEL_RPC_RESPONSE },
-      null,
-      'a rendered line',
-    ]) {
-      assert.equal(
-        isChannelRPCResponse(frame),
-        false,
-        `expected rejection of ${JSON.stringify(frame)}`
-      )
-    }
-  })
-
-  test('a malformed failure payload does not reach the caller as-is', async () => {
-    const registry = new ChannelRPCRegistry()
-    const { id, promise } = registry.register()
-
-    // A peer is free to answer with anything. Without the fallback, `name`
-    // lands on an Error as a non-string and `message` stringifies as
-    // "[object Object]" in whatever logs it.
-    registry.settle({
-      action: CHANNEL_RPC_RESPONSE,
-      id,
-      ok: false,
-      error: { name: 42, message: { nested: true } } as any,
-    })
-
-    await assert.rejects(promise, (e: ChannelRPCError) => {
-      assert.equal(e.name, 'ChannelRPCError')
-      assert.equal(e.message, 'Remote channel RPC failed')
-      assert.equal(e.reason, 'remote')
-      return true
-    })
-  })
-})
-
-/** Stands in for the schema service, which is an ajv wrapper in production. */
-const schemaServices = () => ({
-  logger: {
-    error: () => {},
-    warn: () => {},
-    info: () => {},
-    debug: () => {},
-  },
-  schema: {
-    compileSchema: () => {},
-    validateSchema: (name: string, data: any) => {
-      const schema = pikkuState(null, 'misc', 'schemas').get(name) as any
-      for (const key of schema?.required ?? []) {
-        if (typeof data?.[key] !== schema.properties[key].type) {
-          throw new Error(`Property "${key}" does not match schema.`)
-        }
-      }
-    },
-  },
-})
-
-describe('input validation', () => {
-  /** As codegen would declare it: a name, its function, its argument schema. */
-  const declareInput = (name: string, schema: unknown) => {
-    pikkuState(null, 'rpc', 'meta')[name] = name as any
-    pikkuState(null, 'function', 'meta')[name] = {
-      pikkuFuncId: name,
-      inputSchemaName: `${name}Input`,
-    } as any
-    pikkuState(null, 'misc', 'schemas').set(`${name}Input`, schema as any)
-    return () => {
-      delete pikkuState(null, 'rpc', 'meta')[name]
-      delete pikkuState(null, 'function', 'meta')[name]
-      pikkuState(null, 'misc', 'schemas').delete(`${name}Input`)
-    }
-  }
-
-  const pathSchema = {
-    type: 'object',
-    properties: { path: { type: 'string' } },
-    required: ['path'],
-  }
-
-  const validator = (): ChannelRPCValidator =>
-    createChannelRPCInputValidator(schemaServices() as any)
-
-  test('arguments that do not match the declared input fail before the send', async () => {
-    const release = declareInput('readLocalFile', pathSchema)
-    try {
-      const { service, serverSent } = connect(
-        { readLocalFile: () => 'contents' },
-        undefined,
-        undefined,
-        validator()
-      )
-
-      await assert.rejects(
-        service.invoke('readLocalFile', { path: 42 }),
-        (e: ChannelRPCError) => {
-          assert.equal(e.reason, 'invalid')
-          assert.match(
-            e.message,
-            /Invalid arguments for "readLocalFile": Property "path" does not match schema\./
-          )
-          return true
-        }
-      )
-
-      // Nothing went out. This is version drift, not an attack — the peer must
-      // still check what it is handed — but failing here names the end that
-      // got it wrong instead of surfacing inside someone else's process.
-      assert.deepEqual(serverSent, [])
-      assert.equal(service.registry.inFlight, 0, 'no call is left registered')
-    } finally {
-      release()
-    }
-  })
-
-  test('matching arguments go out untouched', async () => {
-    const release = declareInput('readLocalFile', pathSchema)
-    try {
-      const { service } = connect(
-        { readLocalFile: ({ path }: any) => `contents of ${path}` },
-        undefined,
-        undefined,
-        validator()
-      )
-
-      assert.equal(
-        await service.invoke('readLocalFile', { path: '/etc/hosts' }),
-        'contents of /etc/hosts'
-      )
-    } finally {
-      release()
-    }
-  })
-
-  test('a capability with no declared input is left alone', async () => {
-    const { service } = connect(
-      { whoAmI: () => 'me' },
-      undefined,
-      undefined,
-      validator()
-    )
-
-    assert.equal(await service.invoke('whoAmI', { anything: true }), 'me')
-  })
-})
-
-describe('result validation', () => {
-  /**
-   * Registers a capability the way codegen would: a name in the RPC map, the
-   * function it resolves to, and the schema generated from its return type.
-   */
-  const declareCapability = (name: string, schema: unknown) => {
-    pikkuState(null, 'rpc', 'meta')[name] = name as any
-    pikkuState(null, 'function', 'meta')[name] = {
-      pikkuFuncId: name,
-      outputSchemaName: `${name}Output`,
-    } as any
-    pikkuState(null, 'misc', 'schemas').set(`${name}Output`, schema as any)
-    return () => {
-      delete pikkuState(null, 'rpc', 'meta')[name]
-      delete pikkuState(null, 'function', 'meta')[name]
-      pikkuState(null, 'misc', 'schemas').delete(`${name}Output`)
-    }
-  }
-
-  const checkoutSchema = {
-    type: 'object',
-    properties: { sha: { type: 'string' }, branch: { type: 'string' } },
-    required: ['sha', 'branch'],
-  }
-
-  test('accepts an answer matching the declared return type', async () => {
-    const release = declareCapability('localCheckout', checkoutSchema)
-    try {
-      const { service } = connect(
-        { localCheckout: () => ({ sha: 'deadbeef', branch: 'main' }) },
-        undefined,
-        createChannelRPCResultValidator(schemaServices() as any)
-      )
-
-      assert.deepEqual(await service.invoke('localCheckout', {}), {
-        sha: 'deadbeef',
-        branch: 'main',
-      })
-    } finally {
-      release()
-    }
-  })
-
-  test('rejects an answer that does not match, naming the capability', async () => {
-    const release = declareCapability('localCheckout', checkoutSchema)
-    try {
-      // A client on an older build, or one that simply lies. Either way the
-      // command must not carry on with a `sha` that is not a string.
-      const { service } = connect(
-        { localCheckout: () => ({ sha: null, branch: 'main' }) },
-        undefined,
-        createChannelRPCResultValidator(schemaServices() as any)
-      )
-
-      await assert.rejects(
-        service.invoke('localCheckout', {}),
-        (e: ChannelRPCError) => {
-          assert.equal(e.reason, 'invalid')
-          assert.match(
-            e.message,
-            /Invalid result from "localCheckout": Property "sha" does not match schema\./
-          )
-          return true
-        }
-      )
-    } finally {
-      release()
-    }
-  })
-
-  test('leaves a capability with no declared contract alone', async () => {
-    // Nothing was declared for this name, so there is no shape to check
-    // against — inventing a failure would break a caller that deliberately
-    // treats the answer as opaque.
-    const { service } = connect(
-      { whoAmI: () => 'anything at all' },
-      undefined,
-      createChannelRPCResultValidator(schemaServices() as any)
-    )
-
-    assert.equal(await service.invoke('whoAmI', {}), 'anything at all')
-  })
-
-  test('a failure inside the capability is not reported as invalid', async () => {
-    const release = declareCapability('localCheckout', checkoutSchema)
-    try {
-      const { service } = connect(
-        {
-          localCheckout: () => {
-            throw new Error('not a git repository')
-          },
-        },
-        undefined,
-        createChannelRPCResultValidator(schemaServices() as any)
-      )
-
-      // The peer answered properly — it answered that it failed. Calling that
-      // a validation problem would point at the wrong end of the connection.
-      await assert.rejects(
-        service.invoke('localCheckout', {}),
-        (e: ChannelRPCError) => {
-          assert.equal(e.reason, 'remote')
-          assert.equal(e.message, 'not a git repository')
-          return true
-        }
-      )
-    } finally {
-      release()
-    }
-  })
-})