@productbrain/cli 0.1.0-beta.15 → 0.1.0-beta.1522

package/dist/__tests__/handshake-preview.test.js

@@ -0,0 +1,949 @@
+/**
+ * runHandshake preview/apply/dryRun invariants — WP-332 S1.
+ * STD-197: preview is the new default (no --apply flag = no writes).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createHash } from 'crypto';
+const { vfs, MOCK_MARKER, MOCK_CWD, MOCK_HOME } = vi.hoisted(() => ({
+    vfs: {},
+    MOCK_MARKER: 'auto-generated by pb handshake',
+    MOCK_CWD: '/tmp/pb-preview-cwd',
+    MOCK_HOME: '/tmp/pb-preview-home',
+}));
+const { execSyncMock } = vi.hoisted(() => ({
+    execSyncMock: vi.fn(),
+}));
+vi.mock('fs', () => ({
+    mkdirSync: vi.fn(),
+    writeFileSync: vi.fn((path, content) => {
+        vfs[path] = content;
+    }),
+    existsSync: vi.fn((path) => path in vfs),
+    readFileSync: vi.fn((path, _enc) => {
+        if (path in vfs)
+            return vfs[path];
+        throw Object.assign(new Error(`ENOENT: no such file '${path}'`), { code: 'ENOENT' });
+    }),
+    readdirSync: vi.fn(() => []),
+    copyFileSync: vi.fn(),
+    realpathSync: vi.fn((path) => path),
+}));
+vi.mock('os', () => ({ homedir: vi.fn(() => MOCK_HOME) }));
+vi.mock('child_process', () => ({
+    execSync: (...args) => execSyncMock(...args),
+}));
+vi.mock('../lib/prompts.js', () => ({
+    select: vi.fn(() => Promise.resolve('work')),
+    confirm: vi.fn(() => Promise.resolve(false)),
+    ask: vi.fn(() => Promise.resolve('')),
+    password: vi.fn(() => Promise.resolve('')),
+    isInteractive: vi.fn(() => false),
+}));
+vi.mock('../lib/client.js', () => ({
+    kernelCall: vi.fn().mockResolvedValue([]),
+    kernelCallWithSession: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../lib/session.js', () => ({
+    readSession: vi.fn(() => null),
+    writeSession: vi.fn(),
+    clearSession: vi.fn(),
+    readClosedMarker: vi.fn(() => null),
+    addCapturedEntry: vi.fn(),
+}));
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn().mockResolvedValue({
+        apiKey: 'pb_sk_test',
+        siteUrl: 'https://test.convex.site',
+    }),
+}));
+vi.mock('../lib/repo-detect.js', () => ({
+    detectRepo: vi.fn().mockReturnValue({ name: 'test-repo', detectedStack: [], repoSlug: null }),
+    extractWorkspaceProfile: vi.fn().mockReturnValue(null),
+}));
+vi.mock('../generators/adapters.js', () => ({
+    MARKER: MOCK_MARKER,
+    generateAgentsMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\nagents content`),
+    generateClaudeMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\nclaude content`),
+    generateCursorMdc: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\ncursor content`),
+    generateCopilotMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\ncopilot content`),
+}));
+vi.mock('../generators/portable-knowledge.js', () => ({
+    readCanonicalSkills: vi.fn().mockReturnValue([]),
+    readCanonicalRules: vi.fn().mockReturnValue([]),
+    readPersonalLayer: vi.fn().mockReturnValue([]),
+    readPersonalSkillsLayer: vi.fn().mockReturnValue([]),
+    generateCursorSkill: vi.fn().mockReturnValue(''),
+    generateCursorRule: vi.fn().mockReturnValue(''),
+    generateCodexSkill: vi.fn().mockReturnValue(''),
+    generateClaudeRule: vi.fn().mockReturnValue(''),
+    generateCodexSkillIndex: vi.fn().mockReturnValue(''),
+    generateClaudeSkillRouter: vi.fn().mockReturnValue(''),
+    shouldEmitToTarget: vi.fn().mockReturnValue(false),
+    filterByLevel: vi.fn().mockImplementation((items) => items),
+    evaluateConditions: vi.fn().mockReturnValue({ included: true, reasons: [] }),
+    validateCodexSkills: vi.fn().mockReturnValue([]),
+    STAGE_TO_MAX_LEVEL: {},
+    LEVEL_ORDER: [],
+}));
+vi.mock('../generators/briefing-md.js', () => ({
+    generateBriefingMd: vi.fn().mockReturnValue('briefing content'),
+}));
+vi.mock('../generators/context-md.js', () => ({
+    generateContextMd: vi.fn().mockReturnValue('context content'),
+}));
+vi.mock('../generators/chain-rules.js', () => ({
+    generateChainRules: vi.fn().mockReturnValue({ content: '', stats: {} }),
+}));
+vi.mock('../generators/handshake-diff.js', () => ({
+    saveHandshakeState: vi.fn(),
+    loadPreviousState: vi.fn().mockReturnValue(null),
+    diffHandshakeState: vi.fn().mockReturnValue({ added: [], updated: [], removed: [] }),
+    formatDiff: vi.fn().mockReturnValue(''),
+    buildCurrentState: vi.fn().mockReturnValue({}),
+}));
+vi.mock('../generators/surface-profiles.js', () => ({
+    resolveSurfaceProfile: vi.fn().mockReturnValue({ level: 'intermediate' }),
+}));
+vi.mock('../generators/manifest.js', () => ({
+    readManifest: vi.fn().mockReturnValue(null),
+    readManifestStatus: vi.fn().mockReturnValue({
+        mode: 'project',
+        surfaces: ['.cursor', '.claude', '.codex', '.github'],
+        lock: {},
+        parseStatus: 'ok',
+        manifest: null,
+    }),
+    filterByAdoptionState: vi.fn().mockImplementation((items) => items),
+}));
+vi.mock('../formatters/handshake.js', () => ({
+    formatHandshakeReport: vi.fn().mockReturnValue(''),
+}));
+vi.mock('../lib/hook-intents.js', () => ({
+    composeHooksFromIntents: vi.fn().mockReturnValue({}),
+    getHookStatusForSurface: vi.fn().mockReturnValue([]),
+}));
+vi.mock('../lib/method-registry.js', () => ({
+    loadMethodRegistry: vi.fn().mockResolvedValue({ methods: [] }),
+}));
+import { readdirSync, writeFileSync } from 'fs';
+import { formatHandshakeReport } from '../formatters/handshake.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { readSession } from '../lib/session.js';
+import { detectRepo } from '../lib/repo-detect.js';
+import { readManifestStatus } from '../generators/manifest.js';
+import { generateCursorSkill, shouldEmitToTarget } from '../generators/portable-knowledge.js';
+import { runHandshake } from '../commands/handshake.js';
+function capturedReport() {
+    const calls = vi.mocked(formatHandshakeReport).mock.calls;
+    return calls.length > 0 ? calls[calls.length - 1][0] : null;
+}
+function setupAuthoringTestHash(asset) {
+    const canonical = {
+        entryId: asset.entryId,
+        name: asset.name,
+        description: asset.description,
+        assetKind: asset.assetKind,
+        triggers: asset.triggers ?? [],
+        semanticRefs: asset.semanticRefs ?? [],
+        body: asset.body.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trimEnd(),
+    };
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+}
+describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
+    let cwdSpy;
+    beforeEach(() => {
+        Object.keys(vfs).forEach((k) => delete vfs[k]);
+        vi.clearAllMocks();
+        cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(MOCK_CWD);
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'warn').mockImplementation(() => { });
+        vi.mocked(readdirSync).mockReturnValue([]);
+        execSyncMock.mockReset();
+        execSyncMock.mockImplementation(() => {
+            throw new Error('no git');
+        });
+        vi.mocked(detectRepo).mockReturnValue({
+            name: 'test-repo',
+            description: null,
+            gitRemote: null,
+            repoSlug: null,
+            detectedStack: [],
+            isMonorepo: false,
+        });
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'project',
+            surfaces: ['.cursor', '.claude', '.codex', '.github'],
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
+        });
+    });
+    afterEach(() => {
+        cwdSpy.mockRestore();
+    });
+    it('default (no apply, no dryRun) = preview: writeFileSync is never called', async () => {
+        await runHandshake({});
+        expect(writeFileSync).not.toHaveBeenCalled();
+    });
+    it('apply: true = write mode: writeFileSync is called for new files', async () => {
+        await runHandshake({ apply: true });
+        expect(writeFileSync).toHaveBeenCalled();
+    });
+    it('dryRun: true = backward-compat preview: writeFileSync is never called', async () => {
+        await runHandshake({ dryRun: true });
+        expect(writeFileSync).not.toHaveBeenCalled();
+    });
+    it('threads sanitized local startup signals into the orient view call', async () => {
+        vfs[`${MOCK_CWD}/.productbrain/briefing.md`] = 'Driving entry: WP-462. Review PR #177 and DEC-1244.';
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'wp462-rcrt-activation\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return 'convex/agentKnowledge/startupResolver.ts\n.env.local\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        expect(args.task).toContain('WP-462');
+        expect(args.task).toContain('PR #177');
+        expect(args.task).toContain('DEC-1244');
+        expect(args.startupSignals).toMatchObject({
+            sourceSurface: 'cli',
+            resolverVersion: 'startup-resolution-v1',
+            branchName: 'wp462-rcrt-activation',
+            worktreeName: 'pb-preview-cwd',
+            changedPaths: ['convex/agentKnowledge/startupResolver.ts'],
+            reviewedArtifactRefs: ['WP-462', 'PR #177', 'DEC-1244'],
+            commitSha: 'abc1234',
+        });
+    });
+    it('marks session-start handshake calls with queryable invocation attribution', async () => {
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'wp462-rcrt-activation\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return 'convex/agentKnowledge/startupResolver.ts\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true, invocationPath: 'session-start' });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        expect(orientCall[1].invocationPath).toBe('session-start');
+    });
+    it('does not invent a startup task when local evidence is empty, but still emits an attribution envelope (Codex@704)', async () => {
+        // execSync throws "no git" by default → no branch/commit/path facts.
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        // Codex@704: returning {} here would drop the whole startup block and lose
+        // attribution + the queryable domain-unresolved row in exactly the low-evidence
+        // case the resolver is meant to surface. A minimal envelope must still ride.
+        expect(args.startupSignals).toBeDefined();
+        expect(args.startupSignals.resolverVersion).toBe('startup-resolution-v1');
+        expect(args.startupSignals.sourceSurface).toBe('cli');
+        // No invented task; no fabricated evidence fields.
+        expect(args.task).toBeUndefined();
+        expect(args.startupSignals.taskText).toBeUndefined();
+        expect(args.startupSignals.changedPaths).toBeUndefined();
+        expect(args.startupSignals.reviewedArtifactRefs).toBeUndefined();
+    });
+    it('does not derive startup task text from sanitized-out paths, but keeps attribution (Codex@704)', async () => {
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'misc-cleanup\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return '.env.local\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            // merge-base / branch-delta unavailable in this fixture.
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        // The only "evidence" was a secret-bearing path (.env.local) that sanitization
+        // drops — so no task is invented and no changedPaths leak — but the
+        // attribution envelope (branch + commit) still rides (Codex@704).
+        expect(args.task).toBeUndefined();
+        expect(args.startupSignals).toBeDefined();
+        expect(args.startupSignals.branchName).toBe('misc-cleanup');
+        expect(args.startupSignals.commitSha).toBe('abc1234');
+        expect(args.startupSignals.changedPaths).toBeUndefined();
+        expect(args.startupSignals.taskText).toBeUndefined();
+    });
+    it('apply + observe authority is preview-only and writes nothing', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'observe',
+            surfaces: ['.cursor'],
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
+        });
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        expect(writeFileSync).not.toHaveBeenCalled();
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.materializeSetup')).toBe(false);
+        expect(capturedReport()?.filesWritten).toEqual([]);
+        expect(capturedReport()?.filesSkipped?.some((f) => f.reason === 'preview-only (materialize: observe)')).toBe(true);
+    });
+    it('apply + govern authority writes files and invokes materializeSetup (KEY-24 complement to observe)', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'govern',
+            surfaces: ['.cursor'],
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
+        });
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        expect(writeFileSync).toHaveBeenCalled();
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.materializeSetup')).toBe(true);
+        expect(capturedReport()?.filesSkipped?.some((f) => f.reason === 'preview-only (materialize: observe)')).toBeFalsy();
+    });
+    it('--surfaces is an intersection with manifest.surfaces, not a superset', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'project',
+            surfaces: ['.cursor'],
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
+        });
+        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
+        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return [{
+                        entryId: 'SETUP-SKILL-INTERSECTION',
+                        name: 'Intersection',
+                        description: 'Intersection',
+                        body: '# Intersection',
+                        triggers: [],
+                        assetKind: 'skill',
+                        semanticRefs: [],
+                        disabledByOwner: false,
+                        lastProjectedHash: null,
+                    }];
+            }
+            if (tool === 'setup.getCurrentSetupState')
+                return { effectiveMode: 'observe' };
+            if (tool === 'setup.recordTransition')
+                return { ok: true, receiptId: 'r1', deduped: false };
+            return [];
+        });
+        await runHandshake({ apply: true, surfaces: ['claude'] });
+        expect(writeFileSync).not.toHaveBeenCalledWith(expect.stringContaining('/.cursor/skills/Intersection/SKILL.md'), expect.any(String));
+    });
+    it('apply records a mode-change transition when manifest mode differs from current setup state', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'project',
+            surfaces: ['.cursor'],
+            lock: { 'SETUP-SKILL-TRANSITION': 'workspace' },
+            parseStatus: 'ok',
+            manifest: null,
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser')
+                return [];
+            if (tool === 'setup.getCurrentSetupState')
+                return { effectiveMode: 'observe' };
+            if (tool === 'setup.recordTransition')
+                return { ok: true, receiptId: 'r1', deduped: false };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(kernelCall).toHaveBeenCalledWith('setup.recordTransition', {
+            fromMode: 'observe',
+            toMode: 'project',
+            parseStatus: 'ok',
+            surfaces: ['.cursor'],
+            lock: { 'SETUP-SKILL-TRANSITION': 'workspace' },
+        });
+    });
+    it('apply bulk-imports .productbrain authoring files with frontmatter id before DB projection', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'project',
+            surfaces: ['.cursor'],
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
+        });
+        const skillPath = `${MOCK_CWD}/.productbrain/skills/local.md`;
+        vfs[`${MOCK_CWD}/.productbrain/skills`] = '';
+        vfs[skillPath] = [
+            '---',
+            'id: SETUP-SKILL-FRONTMATTER',
+            'name: Local Skill',
+            'description: Local description',
+            'triggers:',
+            '  - local',
+            'semanticRefs:',
+            '  - entry:WP-423',
+            '---',
+            '# Local Skill',
+            '',
+            'Body.',
+        ].join('\n');
+        vi.mocked(readdirSync).mockImplementation((path) => {
+            if (String(path).endsWith('/.productbrain/skills'))
+                return ['local.md'];
+            return [];
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            // WP-428 S2 (Critical #1): CLI now calls ingestSetupAssetWithBody per-asset.
+            if (tool === 'setup.ingestSetupAssetWithBody')
+                return { action: 'created', entryId: 'SETUP-SKILL-FRONTMATTER' };
+            if (tool === 'setup.listAssetsForUser')
+                return [];
+            if (tool === 'setup.getCurrentSetupState')
+                return { effectiveMode: 'project' };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        // WP-428 S2: CLI now calls ingestSetupAssetWithBody per-asset (not ingestSetupAssetsBatch).
+        expect(kernelCall).toHaveBeenCalledWith('setup.ingestSetupAssetWithBody', expect.objectContaining({
+            entryId: 'SETUP-SKILL-LOCAL',
+            frontmatterId: 'SETUP-SKILL-FRONTMATTER',
+            name: 'Local Skill',
+            description: 'Local description',
+            assetKind: 'skill',
+            triggers: ['local'],
+            semanticRefs: ['entry:WP-423'],
+        }));
+    });
+    it('preview mode reports unchanged for files with identical content', async () => {
+        const agentsPath = `${MOCK_CWD}/AGENTS.md`;
+        vfs[agentsPath] = `<!-- ${MOCK_MARKER} -->\nagents content`;
+        await runHandshake({});
+        expect(writeFileSync).not.toHaveBeenCalled();
+        const report = capturedReport();
+        const entry = report?.previewPlan?.find((e) => e.path.includes('AGENTS.md') && e.status === 'unchanged');
+        expect(entry).toBeDefined();
+    });
+    it('user-owned adapter (file exists without MARKER) = would-augment in previewPlan, no write (TEN-2155)', async () => {
+        // TEN-2155: user-owned CLAUDE.md/AGENTS.md (no MARKER) are now AUGMENTED with a PB
+        // region rather than left fully untouched. In preview mode this shows as 'would-augment'
+        // in the previewPlan. No bytes are written to disk in preview mode.
+        const agentsPath = `${MOCK_CWD}/AGENTS.md`;
+        vfs[agentsPath] = '# Custom AGENTS\nNo auto-generated marker here.';
+        await runHandshake({});
+        expect(writeFileSync).not.toHaveBeenCalled();
+        const report = capturedReport();
+        const entry = report?.previewPlan?.find((e) => e.path.includes('AGENTS.md') && e.status === 'would-augment');
+        expect(entry).toBeDefined();
+        // Never labelled as a "forked" conflict the user must --force away.
+        const forkedEntry = report?.previewPlan?.find((e) => e.status === 'forked');
+        expect(forkedEntry).toBeUndefined();
+    });
+    it('apply: user-owned files (no MARKER) are augmented with a PB region, not skipped (TEN-2155)', async () => {
+        // TEN-2155: user-owned CLAUDE.md/AGENTS.md get a pb:region spliced in — they are
+        // NOT added to userOwnedSkipped. Their original content is preserved; only the PB
+        // region block is appended. They must appear in filesWritten, not filesSkipped.
+        const claudePath = `${MOCK_CWD}/CLAUDE.md`;
+        const agentsPath = `${MOCK_CWD}/AGENTS.md`;
+        const userClaude = '# My own CLAUDE.md\nNo auto-generated marker.';
+        const userAgents = '# My own AGENTS.md\nNo auto-generated marker.';
+        vfs[claudePath] = userClaude;
+        vfs[agentsPath] = userAgents;
+        const report = await runHandshake({ apply: true });
+        // Augmented files appear in filesWritten, not userOwnedSkipped.
+        expect(report?.filesWritten).toEqual(expect.arrayContaining(['CLAUDE.md', 'AGENTS.md']));
+        expect(report?.userOwnedSkipped ?? []).not.toEqual(expect.arrayContaining(['CLAUDE.md']));
+        expect(report?.userOwnedSkipped ?? []).not.toEqual(expect.arrayContaining(['AGENTS.md']));
+        // The augmented content on disk must contain the original user content.
+        expect(vfs[claudePath]).toContain(userClaude);
+        expect(vfs[agentsPath]).toContain(userAgents);
+        // And the PB region sentinel must be present (the full sentinel includes a comment suffix).
+        expect(vfs[claudePath]).toContain('<!-- pb:region:start');
+        expect(vfs[agentsPath]).toContain('<!-- pb:region:start');
+    });
+    it('apply: user-owned files never trigger a chain.createEntry drift TEN, even with an active session + receipts (TEN-2150)', async () => {
+        vfs[`${MOCK_CWD}/CLAUDE.md`] = '# My own CLAUDE.md\nNo auto-generated marker.';
+        vfs[`${MOCK_CWD}/AGENTS.md`] = '# My own AGENTS.md\nNo auto-generated marker.';
+        // Force the EXACT conditions under which the old code logged the spurious draft
+        // TEN: an active write session + a workspace that already has setup receipts
+        // (non-first-run). hasAnyReceipt is ignored post-fix but proves this is a real
+        // RED guard against the removed forked-adapter drift-logging block.
+        vi.mocked(readSession).mockReturnValue({ sessionId: 'test-session' });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => tool === 'setup.listAssetsForUser'
+            ? { activeAssets: [], dormantAssets: [], hasAnyReceipt: true }
+            : []);
+        try {
+            await runHandshake({ apply: true });
+            // The session-bound path is genuinely exercised (materializeSetup runs through it)…
+            expect(kernelCallWithSession).toHaveBeenCalled();
+            // …but NO draft TEN is ever logged about the user's own files.
+            expect(kernelCallWithSession).not.toHaveBeenCalledWith('chain.createEntry', expect.anything());
+        }
+        finally {
+            // Restore defaults — beforeEach clears call history but not implementations.
+            vi.mocked(readSession).mockReturnValue(null);
+            vi.mocked(kernelCall).mockResolvedValue([]);
+        }
+    });
+    it('apply mode projects DB setup assets with body-derived refs, disabled filtering, and hash trailers', async () => {
+        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
+        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
+        vi.mocked(kernelCall).mockImplementation(async (tool, args) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return [
+                    {
+                        entryId: 'SETUP-SKILL-NO-REFS',
+                        name: 'No Refs',
+                        description: 'No ref skill',
+                        body: '# No refs\nPlain body.',
+                        triggers: [],
+                        assetKind: 'skill',
+                        semanticRefs: [],
+                        disabledByOwner: false,
+                        lastProjectedHash: null,
+                    },
+                    {
+                        entryId: 'SETUP-SKILL-WITH-REF',
+                        name: 'With Ref',
+                        description: 'Ref skill',
+                        body: '# With ref\nUse {{ref:entry:WP-345}}.',
+                        triggers: [],
+                        assetKind: 'skill',
+                        semanticRefs: ['entry:WP-345'],
+                        disabledByOwner: false,
+                        lastProjectedHash: null,
+                    },
+                    {
+                        entryId: 'SETUP-SKILL-DISABLED',
+                        name: 'Disabled Skill',
+                        description: 'Disabled',
+                        body: '# Disabled',
+                        triggers: [],
+                        assetKind: 'skill',
+                        semanticRefs: [],
+                        disabledByOwner: true,
+                        lastProjectedHash: null,
+                    },
+                    {
+                        entryId: 'SETUP-BUNDLE-DEMO',
+                        name: 'Bundle Demo',
+                        description: 'Bundle',
+                        body: '# Bundle',
+                        triggers: [],
+                        assetKind: 'bundle',
+                        semanticRefs: [],
+                        disabledByOwner: false,
+                        lastProjectedHash: null,
+                    },
+                ];
+            }
+            if (tool === 'setup.resolveSemanticRefs') {
+                expect(args?.semanticRefs).toEqual(['entry:WP-345']);
+                return [{ ref: 'entry:WP-345', resolved: { entryId: 'WP-345', name: 'Dynamic Skills' } }];
+            }
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 2, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        const writes = vi.mocked(writeFileSync).mock.calls.map(([path, content]) => ({
+            path: String(path),
+            content: String(content),
+        }));
+        const noRefs = writes.find((w) => w.path.endsWith('/.cursor/skills/No Refs/SKILL.md'));
+        const withRef = writes.find((w) => w.path.endsWith('/.cursor/skills/With Ref/SKILL.md'));
+        expect(noRefs?.content).toContain('Plain body.');
+        expect(noRefs?.content).toContain('<!-- pb-hash: sha256:');
+        expect(withRef?.content).toContain('Use {{ref:entry:WP-345}}.');
+        expect(withRef?.content).toContain('<!-- pb-hash: sha256:');
+        expect(writes.some((w) => w.path.includes('Disabled Skill'))).toBe(false);
+        expect(writes.some((w) => w.path.includes('Bundle Demo'))).toBe(false);
+        const hashUpdates = vi.mocked(kernelCall).mock.calls.filter(([tool]) => tool === 'setup.updateLastProjectedHash');
+        expect(hashUpdates).toHaveLength(2);
+        expect(hashUpdates.map(([, args]) => args.entryId).sort()).toEqual([
+            'SETUP-SKILL-NO-REFS',
+            'SETUP-SKILL-WITH-REF',
+        ]);
+    });
+    it('does not update lastProjectedHash when a DB asset projection is forked and skipped', async () => {
+        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
+        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return [
+                    {
+                        entryId: 'SETUP-SKILL-FORKED',
+                        name: 'Forked Skill',
+                        description: 'Forked',
+                        body: '# Forked\nBody.',
+                        triggers: [],
+                        assetKind: 'skill',
+                        semanticRefs: [],
+                        disabledByOwner: false,
+                        lastProjectedHash: null,
+                    },
+                ];
+            }
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        vfs[`${MOCK_CWD}/.cursor/skills/Forked Skill/SKILL.md`] = '# User fork\nNo generated marker.';
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(false);
+    });
+    it('writes missing caller-owned personal DB assets back to .productbrain authoring files', async () => {
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-PERSONAL',
+                            name: 'Personal Skill',
+                            description: 'Personal authoring row.',
+                            body: '# Personal Skill\nBody.',
+                            triggers: ['personal'],
+                            assetKind: 'skill',
+                            semanticRefs: ['entry:WP-423'],
+                            disabledByOwner: false,
+                            lastProjectedHash: null,
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        const path = `${MOCK_CWD}/.productbrain/skills/Personal Skill.md`;
+        expect(vfs[path]).toContain('id: SETUP-SKILL-PERSONAL');
+        expect(vfs[path]).toContain('# Personal Skill\nBody.');
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(true);
+    });
+    it('writes newer DB edits over a tracked authoring file unchanged from baseline', async () => {
+        const baselineHash = setupAuthoringTestHash({
+            entryId: 'SETUP-SKILL-DB-WINS',
+            name: 'DB Wins',
+            description: 'DB should win.',
+            assetKind: 'skill',
+            body: '# Original',
+        });
+        vfs[`${MOCK_CWD}/.productbrain/skills`] = '';
+        vfs[`${MOCK_CWD}/.productbrain/skills/DB Wins.md`] = [
+            '---',
+            'id: SETUP-SKILL-DB-WINS',
+            'name: "DB Wins"',
+            'description: "DB should win."',
+            'assetKind: skill',
+            '---',
+            '# Original',
+            '',
+        ].join('\n');
+        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
+            version: 1,
+            assets: {
+                'SETUP-SKILL-DB-WINS': {
+                    path: '.productbrain/skills/DB Wins.md',
+                    hash: baselineHash,
+                },
+            },
+        });
+        vi.mocked(readdirSync).mockImplementation((path) => {
+            if (String(path).endsWith('/.productbrain/skills'))
+                return ['DB Wins.md'];
+            return [];
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            // WP-428 S2 (Critical #1): CLI now calls ingestSetupAssetWithBody per-asset.
+            if (tool === 'setup.ingestSetupAssetWithBody') {
+                return { action: 'unchanged', entryId: 'SETUP-SKILL-DB-WINS' };
+            }
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-DB-WINS',
+                            name: 'DB Wins',
+                            description: 'DB should win.',
+                            body: '# DB edit',
+                            triggers: [],
+                            assetKind: 'skill',
+                            semanticRefs: [],
+                            disabledByOwner: false,
+                            lastProjectedHash: baselineHash,
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(vfs[`${MOCK_CWD}/.productbrain/skills/DB Wins.md`]).toContain('# DB edit');
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(true);
+    });
+    it('marks personal DB assets dormant when their tracked authoring file is deleted', async () => {
+        const syncedHash = setupAuthoringTestHash({
+            entryId: 'SETUP-SKILL-DELETED',
+            name: 'Deleted Skill',
+            description: 'Deleted authoring row.',
+            assetKind: 'skill',
+            body: '# Deleted Skill\nBody.',
+        });
+        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
+            version: 1,
+            assets: {
+                'SETUP-SKILL-DELETED': {
+                    path: '.productbrain/skills/Deleted Skill.md',
+                    hash: syncedHash,
+                },
+            },
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-DELETED',
+                            name: 'Deleted Skill',
+                            description: 'Deleted authoring row.',
+                            body: '# Deleted Skill\nBody.',
+                            triggers: [],
+                            assetKind: 'skill',
+                            semanticRefs: [],
+                            disabledByOwner: false,
+                            lastProjectedHash: syncedHash,
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.markPersonalSetupAssetDormantFromSync')
+                return { action: 'dormant', entryId: 'SETUP-SKILL-DELETED' };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 0, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(vi.mocked(kernelCall).mock.calls).toContainEqual([
+            'setup.markPersonalSetupAssetDormantFromSync',
+            { entryId: 'SETUP-SKILL-DELETED', expectedLastProjectedHash: syncedHash },
+        ]);
+    });
+    it('does not mark a stale tracked deletion dormant when the DB baseline changed', async () => {
+        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
+            version: 1,
+            assets: {
+                'SETUP-SKILL-STALE': {
+                    path: '.productbrain/skills/Stale Skill.md',
+                    hash: 'sha256:old-baseline',
+                },
+            },
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-STALE',
+                            name: 'Stale Skill',
+                            description: 'DB changed after local sync.',
+                            body: '# Stale Skill\nUpdated DB body.',
+                            triggers: [],
+                            assetKind: 'skill',
+                            semanticRefs: [],
+                            disabledByOwner: false,
+                            lastProjectedHash: 'sha256:new-baseline',
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.markPersonalSetupAssetDormantFromSync')).toBe(false);
+        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Stale Skill.md`]).toContain('Updated DB body.');
+    });
+    it('does not write a stale snapshot back when dormant sync returns a server-side conflict', async () => {
+        const listedHash = setupAuthoringTestHash({
+            entryId: 'SETUP-SKILL-RACE',
+            name: 'Race Skill',
+            description: 'Race during sync.',
+            assetKind: 'skill',
+            body: '# Race Skill\nDB body.',
+        });
+        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
+            version: 1,
+            assets: {
+                'SETUP-SKILL-RACE': {
+                    path: '.productbrain/skills/Race Skill.md',
+                    hash: listedHash,
+                },
+            },
+        });
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-RACE',
+                            name: 'Race Skill',
+                            description: 'Race during sync.',
+                            body: '# Race Skill\nDB body.',
+                            triggers: [],
+                            assetKind: 'skill',
+                            semanticRefs: [],
+                            disabledByOwner: false,
+                            lastProjectedHash: listedHash,
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.markPersonalSetupAssetDormantFromSync')
+                return { action: 'conflict', entryId: 'SETUP-SKILL-RACE' };
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(vi.mocked(kernelCall).mock.calls).toContainEqual([
+            'setup.markPersonalSetupAssetDormantFromSync',
+            { entryId: 'SETUP-SKILL-RACE', expectedLastProjectedHash: listedHash },
+        ]);
+        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Race Skill.md`]).toBeUndefined();
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool, args]) => tool === 'setup.updateLastProjectedHash' &&
+            args?.entryId === 'SETUP-SKILL-RACE')).toBe(false);
+    });
+    it('does not mark a missing personal authoring file dormant on a fresh clone without local tracking state', async () => {
+        vi.mocked(kernelCall).mockImplementation(async (tool) => {
+            if (tool === 'chain.workspaceReadiness')
+                return null;
+            if (tool === 'chain.getOrientView')
+                return null;
+            if (tool === 'chain.searchEntries')
+                return [];
+            if (tool === 'setup.listAssetsForUser') {
+                return {
+                    activeAssets: [
+                        {
+                            entryId: 'SETUP-SKILL-FRESH',
+                            name: 'Fresh Skill',
+                            description: 'Fresh clone row.',
+                            body: '# Fresh Skill\nBody.',
+                            triggers: [],
+                            assetKind: 'skill',
+                            semanticRefs: [],
+                            disabledByOwner: false,
+                            lastProjectedHash: 'sha256:previous',
+                            scope: 'personal',
+                        },
+                    ],
+                    dormantAssets: [],
+                    hasAnyReceipt: true,
+                };
+            }
+            if (tool === 'setup.updateLastProjectedHash')
+                return { ok: true };
+            if (tool === 'setup.materializeSetup')
+                return { ok: true, assetCount: 1, receiptWritten: true };
+            return [];
+        });
+        await runHandshake({ apply: true });
+        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.markPersonalSetupAssetDormantFromSync')).toBe(false);
+        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Fresh Skill.md`]).toContain('id: SETUP-SKILL-FRESH');
+    });
+});
+//# sourceMappingURL=handshake-preview.test.js.map