@principles/pd-cli 1.152.12 → 1.152.14

package/tests/services/pd-config-loader.test.ts

@@ -1,505 +0,0 @@
-/**
- * pd-config-loader tests — PRI-305
- *
- * Covers:
- *   - Missing config → defaults with nextAction
- *   - Malformed config → fail loud with errors and nextAction
- *   - Valid config → effective config with source='user_config'
- *   - OpenClaw reference summary shows safe label/id only
- *   - PD-local profile summary shows apiKeyEnv, not secret value
- *   - Per-agent override summary
- *   - No secret output in any result
- *   - Legacy file detection
- *   - JSON purity of outputs
- */
-
-import { describe, it, expect } from 'vitest';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import * as yaml from 'js-yaml';
-import {
-  loadPdConfig,
-  computeFlagsFromLoadResult,
-  redactLoadResult,
-  getPdConfigPath,
-  PD_CONFIG_DIR,
-  PD_CONFIG_FILENAME,
-} from '../../src/services/pd-config-loader.js';
-
-// ── Helpers ─────────────────────────────────────────────────────────────────
-
-function mkTmpDir(): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'pd-config-loader-test-'));
-}
-
-function rmTmpDir(dir: string): void {
-  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
-}
-
-function writeConfig(workspaceDir: string, content: string): void {
-  // CWE-22 boundary guard for test helpers: every config path is derived
-  // from an mkdtemp dir under os.tmpdir(); verify that invariant before IO.
-  const tmpRoot = path.resolve(os.tmpdir());
-  const wsRoot = path.resolve(workspaceDir);
-  if (!wsRoot.startsWith(tmpRoot + path.sep)) {
-    throw new Error(`Test helper refuses non-tmpdir workspace: ${workspaceDir}`);
-  }
-  const configDir = path.join(wsRoot, PD_CONFIG_DIR);
-  fs.mkdirSync(configDir, { recursive: true });
-  fs.writeFileSync(path.join(configDir, PD_CONFIG_FILENAME), content, 'utf8');
-}
-
-function makeValidConfigYaml(): string {
-  return yaml.dump({
-    version: 1,
-    features: {
-      prompt: { category: 'core', enabled: true },
-      code_tool_hook: { category: 'core', enabled: true },
-      defer_archive: { category: 'core', enabled: true },
-      correction_observer: { category: 'quiet', enabled: false },
-      gfi: { category: 'quiet', enabled: false },
-    },
-    runtimeProfiles: {
-      'openclaw.default': { type: 'openclaw', source: 'default' },
-      'openclaw.model.lmstudio.qwen3': { type: 'openclaw', provider: 'lmstudio', model: 'qwen3.6-27b-mtp' },
-      'pd.anthropic-sonnet': { type: 'pi-ai', provider: 'anthropic', model: 'claude-3-5-sonnet', apiKeyEnv: 'ANTHROPIC_API_KEY', timeoutMs: 300000 },
-    },
-    internalAgents: {
-      defaultRuntime: 'openclaw.default',
-      agents: {
-        diagnostician: { enabled: true, runtimeProfile: 'openclaw.model.lmstudio.qwen3' },
-        dreamer: { enabled: true },
-        scribe: { enabled: true },
-        artificer: { enabled: true },
-        philosopher: { enabled: false },
-        evaluator: { enabled: false },
-        rolloutReviewer: { enabled: false },
-        correctionObserver: { enabled: false },
-      },
-    },
-    ui: { diagnostics: { mode: 'simple' } },
-  });
-}
-
-// ── getPdConfigPath ──────────────────────────────────────────────────────────
-
-describe('getPdConfigPath', () => {
-  it('returns path under .pd/config.yaml', () => {
-    expect(getPdConfigPath('/workspace/project')).toBe(
-      path.join('/workspace/project', '.pd', 'config.yaml'),
-    );
-  });
-});
-
-// ── Missing config → defaults ────────────────────────────────────────────────
-
-describe('Missing config → defaults', () => {
-  it('returns ok=true with source=defaults when config file is absent', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(true);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(result.source).toBe('defaults');
-      expect(result.effective.config.version).toBe(1);
-      expect(result.effective.config.features.prompt.enabled).toBe(true);
-      expect(result.effective.config.features.code_tool_hook.enabled).toBe(true);
-      expect(result.effective.config.features.defer_archive.enabled).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('defaults include all MVP core features enabled', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      const { features } = result.effective.config;
-      expect(features.prompt.enabled).toBe(true);
-      expect(features.prompt.category).toBe('core');
-      expect(features.code_tool_hook.enabled).toBe(true);
-      expect(features.defer_archive.enabled).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('defaults include gone features disabled', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(result.effective.config.features.nocturnal.enabled).toBe(false);
-      expect(result.effective.config.features.nocturnal.category).toBe('gone');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('defaults include openclaw.default runtime profile', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(Object.hasOwn(result.effective.config.runtimeProfiles, 'openclaw.default')).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── Malformed config → fail loud ────────────────────────────────────────────
-
-describe('Malformed config → fail loud', () => {
-  it('returns ok=false with errors for YAML parse error', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, 'version: [unterminated');
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(false);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.source).toBe('malformed');
-      expect(result.errors.length).toBeGreaterThan(0);
-      expect(result.errors[0].reason).toMatch(/YAML parse error/i);
-      expect(result.errors[0].nextAction).toBeTruthy();
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('returns ok=false with errors for invalid version', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, yaml.dump({ version: 99, features: {}, runtimeProfiles: {}, internalAgents: { defaultRuntime: 'x', agents: {} } }));
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(false);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.errors.some(e => e.path === 'version')).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('returns ok=false with errors for missing features', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, yaml.dump({ version: 1, runtimeProfiles: { 'openclaw.default': { type: 'openclaw', source: 'default' } }, internalAgents: { defaultRuntime: 'openclaw.default', agents: {} } }));
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(false);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.errors.some(e => e.path === 'features')).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('returns ok=false with errors for non-boolean enabled', () => {
-    const tmp = mkTmpDir();
-    const config = yaml.dump({
-      version: 1,
-      features: { prompt: { category: 'core', enabled: 'yes' } },
-      runtimeProfiles: { 'openclaw.default': { type: 'openclaw', source: 'default' } },
-      internalAgents: { defaultRuntime: 'openclaw.default', agents: {} },
-    });
-    writeConfig(tmp, config);
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(false);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.errors.some(e => e.path.includes('enabled'))).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('returns ok=false with errors for forbidden secret field', () => {
-    const tmp = mkTmpDir();
-    const config = yaml.dump({
-      version: 1,
-      features: { prompt: { category: 'core', enabled: true } },
-      runtimeProfiles: {
-        'bad.profile': { type: 'openclaw', apiKey: 'sk-1234567890abcdef' },
-        'openclaw.default': { type: 'openclaw', source: 'default' },
-      },
-      internalAgents: { defaultRuntime: 'openclaw.default', agents: {} },
-    });
-    writeConfig(tmp, config);
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(false);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.errors.some(e => e.reason.includes('forbidden secret field'))).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('each error has reason and nextAction', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, 'version: [unterminated');
-    try {
-      const result = loadPdConfig(tmp);
-      if (result.ok) throw new Error('Expected error');
-      for (const error of result.errors) {
-        expect(error.reason.length).toBeGreaterThan(0);
-        expect(error.nextAction.length).toBeGreaterThan(0);
-      }
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('malformed result still provides usable defaults', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, 'version: [unterminated');
-    try {
-      const result = loadPdConfig(tmp);
-      if (result.ok) throw new Error('Expected error');
-      expect(result.defaults.config.version).toBe(1);
-      expect(result.defaults.config.features.prompt.enabled).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── Valid config → effective config ──────────────────────────────────────────
-
-describe('Valid config → effective config', () => {
-  it('returns ok=true with source=user_config for valid config', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.ok).toBe(true);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(result.source).toBe('user_config');
-      expect(result.effective.config.version).toBe(1);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('preserves user feature overrides', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(result.effective.config.features.correction_observer.enabled).toBe(false);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('preserves runtime profiles', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(Object.hasOwn(result.effective.config.runtimeProfiles, 'pd.anthropic-sonnet')).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── OpenClaw reference summary ───────────────────────────────────────────────
-
-describe('OpenClaw reference summary', () => {
-  it('shows safe label without secrets', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const ocProfile = summary.runtimeProfiles.find(p => p.id === 'openclaw.model.lmstudio.qwen3');
-      expect(ocProfile).toBeDefined();
-      expect(ocProfile!.type).toBe('openclaw');
-      expect(ocProfile!.label).toContain('openclaw');
-      expect(ocProfile!.label).toContain('lmstudio');
-      expect(ocProfile!.apiKeyEnv).toBeUndefined();
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('does not contain raw provider object', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const json = JSON.stringify(summary);
-      expect(json).not.toContain('"apiKey"');
-      expect(json).not.toContain('"gatewayToken"');
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── PD-local profile summary ────────────────────────────────────────────────
-
-describe('PD-local profile summary', () => {
-  it('shows apiKeyEnv name, not value', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const pdProfile = summary.runtimeProfiles.find(p => p.id === 'pd.anthropic-sonnet');
-      expect(pdProfile).toBeDefined();
-      expect(pdProfile!.apiKeyEnv).toBe('ANTHROPIC_API_KEY');
-      const json = JSON.stringify(summary);
-      expect(json).not.toContain('sk-ant-');
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── Per-agent override summary ───────────────────────────────────────────────
-
-describe('Per-agent override summary', () => {
-  it('diagnostician uses explicit override, not defaultRuntime', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const diag = summary.agents.find(a => a.name === 'diagnostician');
-      expect(diag).toBeDefined();
-      expect(diag!.runtimeProfileId).toBe('openclaw.model.lmstudio.qwen3');
-      expect(diag!.runtimeProfileLabel).toContain('lmstudio');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('agent without override uses defaultRuntime', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const dreamer = summary.agents.find(a => a.name === 'dreamer');
-      expect(dreamer).toBeDefined();
-      expect(dreamer!.runtimeProfileId).toBe('openclaw.default');
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── No secret output ─────────────────────────────────────────────────────────
-
-describe('No secret output', () => {
-  it('redacted summary never contains raw API key values', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const json = JSON.stringify(summary);
-      expect(json).not.toContain('sk-ant-');
-      expect(json).not.toContain('sk-');
-      expect(json).not.toContain('"apiKey"');
-      expect(json).not.toContain('"baseUrl"');
-      expect(json).not.toContain('"gatewayToken"');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('load result itself never contains secret values', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const json = JSON.stringify(result);
-      // apiKeyEnv is a field name, not a value — the value would be like "sk-ant-..."
-      expect(json).not.toMatch(/sk-ant-[a-zA-Z0-9]{8,}/);
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── Feature flags from config ────────────────────────────────────────────────
-
-describe('Feature flags from config', () => {
-  it('computeFlagsFromLoadResult returns MVP core channels enabled', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      const flags = computeFlagsFromLoadResult(result);
-      expect(flags.enabledChannels).toContain('prompt');
-      expect(flags.enabledChannels).toContain('code_tool_hook');
-      expect(flags.enabledChannels).toContain('defer_archive');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('computeFlagsFromLoadResult works with malformed config (uses defaults)', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, 'version: [unterminated');
-    try {
-      const result = loadPdConfig(tmp);
-      const flags = computeFlagsFromLoadResult(result);
-      expect(flags.enabledChannels).toContain('prompt');
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── Legacy file detection ────────────────────────────────────────────────────
-
-describe('Legacy file detection', () => {
-  it('detects .pd/feature-flags.yaml', () => {
-    const tmp = mkTmpDir();
-    const pdDir = path.join(tmp, '.pd');
-    fs.mkdirSync(pdDir, { recursive: true });
-    fs.writeFileSync(path.join(pdDir, 'feature-flags.yaml'), 'prompt:\n  enabled: true\n', 'utf8');
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.legacyFilesDetected.length).toBeGreaterThan(0);
-      expect(result.legacyFilesDetected[0]).toContain('feature-flags.yaml');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('detects .state/workflows.yaml', () => {
-    const tmp = mkTmpDir();
-    const stateDir = path.join(tmp, '.state');
-    fs.mkdirSync(stateDir, { recursive: true });
-    fs.writeFileSync(path.join(stateDir, 'workflows.yaml'), 'version: 1\n', 'utf8');
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.legacyFilesDetected.length).toBeGreaterThan(0);
-      expect(result.legacyFilesDetected[0]).toContain('workflows.yaml');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('includes legacy warning when legacy files detected', () => {
-    const tmp = mkTmpDir();
-    const pdDir = path.join(tmp, '.pd');
-    fs.mkdirSync(pdDir, { recursive: true });
-    fs.writeFileSync(path.join(pdDir, 'feature-flags.yaml'), 'prompt:\n  enabled: true\n', 'utf8');
-    try {
-      const result = loadPdConfig(tmp);
-      if (!result.ok) throw new Error('Expected ok');
-      expect(result.warnings.some(w => w.includes('Legacy config files detected'))).toBe(true);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('PRI-404: includes legacyFileNextActions with rm command when legacy files detected', () => {
-    const tmp = mkTmpDir();
-    const stateDir = path.join(tmp, '.state');
-    fs.mkdirSync(stateDir, { recursive: true });
-    fs.writeFileSync(path.join(stateDir, 'workflows.yaml'), 'version: 1\n', 'utf8');
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.legacyFileNextActions.length).toBeGreaterThan(0);
-      expect(result.legacyFileNextActions[0]).toContain('rm ');
-      expect(result.legacyFileNextActions[0]).toContain('workflows.yaml');
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('PRI-404: legacyFileNextActions is empty when no legacy files', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      expect(result.legacyFileNextActions).toEqual([]);
-    } finally { rmTmpDir(tmp); }
-  });
-});
-
-// ── JSON purity ──────────────────────────────────────────────────────────────
-
-describe('JSON purity', () => {
-  it('redacted summary is a single parseable JSON object', () => {
-    const tmp = mkTmpDir();
-    writeConfig(tmp, makeValidConfigYaml());
-    try {
-      const result = loadPdConfig(tmp);
-      const summary = redactLoadResult(result);
-      const json = JSON.stringify(summary, null, 2);
-      const parsed = JSON.parse(json);
-      expect(typeof parsed).toBe('object');
-      expect(parsed).not.toBeNull();
-      expect(Array.isArray(parsed)).toBe(false);
-    } finally { rmTmpDir(tmp); }
-  });
-
-  it('feature flags result is a single parseable JSON object', () => {
-    const tmp = mkTmpDir();
-    try {
-      const result = loadPdConfig(tmp);
-      const flags = computeFlagsFromLoadResult(result);
-      const json = JSON.stringify(flags, null, 2);
-      const parsed = JSON.parse(json);
-      expect(typeof parsed).toBe('object');
-      expect(parsed).not.toBeNull();
-      expect(Array.isArray(parsed)).toBe(false);
-    } finally { rmTmpDir(tmp); }
-  });
-});

package/tests/services/proven-channel-baseline-runner.test.ts

@@ -1,30 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import * as path from 'path';
-import * as os from 'os';
-import { isProductionWorkspace } from '../../src/services/proven-channel-baseline-runner.js';
-
-describe('isProductionWorkspace (real implementation)', () => {
-  it('blocks exact production workspace path', () => {
-    const homedirWorkspace = path.join(os.homedir(), '.openclaw', 'workspace');
-    expect(isProductionWorkspace(homedirWorkspace)).toBe(true);
-  });
-
-  it('blocks descendant of production workspace', () => {
-    const homedirWorkspace = path.join(os.homedir(), '.openclaw', 'workspace', 'my-project');
-    expect(isProductionWorkspace(homedirWorkspace)).toBe(true);
-  });
-
-  it('does NOT block sibling path with different prefix', () => {
-    const sibling = path.join(os.homedir(), '.openclaw', 'workspace-extra');
-    expect(isProductionWorkspace(sibling)).toBe(false);
-  });
-
-  it('does NOT block unrelated path', () => {
-    expect(isProductionWorkspace('C:\\Users\\test\\project')).toBe(false);
-  });
-
-  it('does NOT block temp directory', () => {
-    const tmp = os.tmpdir();
-    expect(isProductionWorkspace(tmp)).toBe(false);
-  });
-});

package/tests/services/quality-scorecard/strong-model-gate.test.ts

@@ -1,133 +0,0 @@
-/**
- * Tests for strong-model-gate URL validation (PRI-361 / PRI-547).
- *
- * Threat model: OPENAI_BASE_URL is operator configuration (trusted), so
- * local/private OpenAI-compatible endpoints must work. What stays blocked:
- * non-http(s) schemes, malformed URLs, embedded credentials.
- *
- * Covers:
- * - Public HTTPS endpoint allowed
- * - Explicit local HTTP endpoint allowed (localhost / 127.0.0.1 / private LAN)
- * - Non-http(s) schemes rejected (file:, javascript:, data:)
- * - Malformed URL rejected
- * - Embedded credentials rejected
- * - Endpoint derivation appends /chat/completions correctly
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { assertSafeLlmBaseUrl } from '../../../src/services/quality-scorecard/strong-model-gate.js';
-
-// ── assertSafeLlmBaseUrl ────────────────────────────────────────────────────
-
-describe('assertSafeLlmBaseUrl — operator-configured provider URLs', () => {
-  it('allows public HTTPS endpoint', () => {
-    const url = assertSafeLlmBaseUrl('https://api.openai.com/v1');
-    expect(url.protocol).toBe('https:');
-    expect(url.hostname).toBe('api.openai.com');
-  });
-
-  it('allows public HTTP endpoint (operator choice)', () => {
-    const url = assertSafeLlmBaseUrl('http://model.example.com/v1');
-    expect(url.protocol).toBe('http:');
-  });
-
-  it('allows localhost local LLM endpoint (llama.cpp / LM Studio)', () => {
-    const url = assertSafeLlmBaseUrl('http://localhost:1234/v1');
-    expect(url.hostname).toBe('localhost');
-    expect(url.port).toBe('1234');
-  });
-
-  it('allows 127.0.0.1 loopback local LLM endpoint', () => {
-    const url = assertSafeLlmBaseUrl('http://127.0.0.1:8080/v1');
-    expect(url.hostname).toBe('127.0.0.1');
-  });
-
-  it('allows private LAN OpenAI-compatible endpoint', () => {
-    const url = assertSafeLlmBaseUrl('http://192.168.1.50:8000/v1');
-    expect(url.hostname).toBe('192.168.1.50');
-  });
-
-  it('allows 10.x private endpoint', () => {
-    const url = assertSafeLlmBaseUrl('http://10.0.0.5:9000/v1');
-    expect(url.hostname).toBe('10.0.0.5');
-  });
-
-  it('rejects file: scheme', () => {
-    expect(() => assertSafeLlmBaseUrl('file:///tmp/foo')).toThrow(/protocol must be http or https/);
-  });
-
-  it('rejects javascript: scheme', () => {
-    expect(() => assertSafeLlmBaseUrl('javascript:alert(1)')).toThrow(/protocol must be http or https/);
-  });
-
-  it('rejects data: scheme', () => {
-    expect(() => assertSafeLlmBaseUrl('data:text/plain,hello')).toThrow(/protocol must be http or https/);
-  });
-
-  it('rejects malformed URL', () => {
-    expect(() => assertSafeLlmBaseUrl('not a url at all')).toThrow(/not a valid URL/);
-    expect(() => assertSafeLlmBaseUrl('http://')).toThrow(/not a valid URL/);
-  });
-
-  it('rejects embedded credentials in URL', () => {
-    expect(() => assertSafeLlmBaseUrl('https://user:pass@api.openai.com/v1')).toThrow(
-      /credentials must not be embedded/,
-    );
-  });
-
-  it('rejects empty string', () => {
-    expect(() => assertSafeLlmBaseUrl('')).toThrow(/not a valid URL/);
-  });
-});
-
-// ── Endpoint derivation (integration via adjudicate) ────────────────────────
-
-describe('strong-model-gate adjudicate endpoint derivation', () => {
-  const origEnv = { ...process.env };
-
-  beforeEach(() => {
-    vi.resetModules();
-    vi.stubGlobal('fetch', vi.fn());
-  });
-
-  afterEach(() => {
-    process.env = { ...origEnv };
-    vi.unstubAllGlobals();
-  });
-
-  it('derives /chat/completions from a local base URL with trailing slash', async () => {
-    process.env.OPENAI_BASE_URL = 'http://localhost:1234/v1/';
-    process.env.OPENAI_API_KEY = 'test-key';
-
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        choices: [{ message: { content: '{"scores":{"G1":2,"G2":2,"G3":2,"G4":2,"G5":2,"G6":2,"G7":2},"rationale":"ok","verdict":"pass"}' } }],
-      }),
-    });
-    vi.stubGlobal('fetch', fetchMock);
-
-    const { adjudicate } = await import('../../../src/services/quality-scorecard/strong-model-gate.js');
-    const result = await adjudicate(
-      {
-        episodeId: 'ep-1',
-        source: 'tool_failure',
-        score: 80,
-        severity: 'high',
-        summary: 'test episode',
-        evolutionTaskResolution: null,
-        linkedPrinciples: [],
-      } as any,
-      {
-        model: 'local',
-        dimensionScores: { G1: 2, G2: 2, G3: 2, G4: 2, G5: 2, G6: 2, G7: 2 },
-        dimensionRationales: {},
-        flags: [],
-      } as any,
-      { modelId: 'gpt-test', log: () => {} },
-    );
-
-    const calledUrl = fetchMock.mock.calls[0][0] as string;
-    expect(calledUrl).toBe('http://localhost:1234/v1/chat/completions');
-    expect(result.adjudicationStatus).toBe('pass');
-  });
-});