@stigmer/cli 3.35.0 → 3.36.0

package/src/commands/auth/whoami.test.ts

@@ -1,96 +0,0 @@
-// Unit tests for `stigmer auth whoami`'s result (commands/auth/whoami.ts;
-// 20260911.11 A3): the command runs the SDK's ensureMyIdentityAccount — the
-// same first-sign-in flow the console runs — and RENDERS what it learned.
-// whoamiResult is the pure half: given the account and whether this call
-// created it, the CommandResult a person reads. A first sign-in says so
-// (visibility of system status); a missing organization is a hint, not a
-// failure; an empty profile (the unconfigured laptop's operator) renders
-// only the fields it has. Accounts are built with the generated schema
-// (DD-007: the generated type is the contract; refinement 12, slice 4).
-
-import { create } from "@bufbuild/protobuf";
-import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-import { describe, expect, it } from "vitest";
-
-import { whoamiResult } from "./whoami.js";
-
-const ALICE = {
-  metadata: { id: "ida_wtr3jcf281yfk9xx61kj59fsme", name: "alice@example.com" },
-  spec: {
-    idpId: "auth0|alice",
-    email: "alice@example.com",
-    firstName: "Alice",
-    lastName: "Liddell",
-    isMachineAccount: false,
-  },
-};
-const ACCOUNT = create(IdentityAccountSchema, ALICE);
-
-function fields(
-  result: ReturnType<typeof whoamiResult>,
-): Record<string, string> {
-  return Object.fromEntries(
-    result.sections.flatMap((s) => s.fields.map((f) => [f.key, f.value])),
-  );
-}
-
-describe("whoamiResult", () => {
-  it("renders an existing account as 'Authenticated' with its identity fields", () => {
-    const result = whoamiResult(ACCOUNT, { created: false, org: "acme" });
-    expect(result.status).toBe("success");
-    expect(result.message).toBe("Authenticated");
-    expect(fields(result)).toEqual({
-      "Account ID": "ida_wtr3jcf281yfk9xx61kj59fsme",
-      Name: "alice@example.com",
-      Email: "alice@example.com",
-      "Full Name": "Alice Liddell",
-      "Account Type": "User Account",
-      Organization: "acme",
-    });
-    expect(result.hints).toEqual([]);
-  });
-
-  it("says so when this call created the account — the first sign-in is visible, never silent", () => {
-    const result = whoamiResult(ACCOUNT, { created: true, org: "acme" });
-    expect(result.status).toBe("success");
-    expect(result.message).toBe(
-      "Authenticated — your account was created on this first sign-in",
-    );
-    expect(fields(result)["Account ID"]).toBe("ida_wtr3jcf281yfk9xx61kj59fsme");
-  });
-
-  it("a missing organization is a hint with the command that sets it", () => {
-    const result = whoamiResult(ACCOUNT, { created: false, org: "" });
-    expect(fields(result).Organization).toBeUndefined();
-    expect(result.hints).toEqual([
-      "No organization set. Use: stigmer config context set --org <slug>",
-    ]);
-  });
-
-  it("renders only the fields an empty profile has (the unconfigured laptop's operator)", () => {
-    const result = whoamiResult(
-      create(IdentityAccountSchema, {
-        metadata: { id: "ida_fn0zdvkkkhhrb4wry43zba8gnn", name: "system" },
-        spec: { idpId: "local|system" },
-      }),
-      { created: false, org: "local" },
-    );
-    expect(fields(result)).toEqual({
-      "Account ID": "ida_fn0zdvkkkhhrb4wry43zba8gnn",
-      Name: "system",
-      "Account Type": "User Account",
-      Organization: "local",
-    });
-  });
-
-  it("names a machine account", () => {
-    const result = whoamiResult(
-      create(IdentityAccountSchema, {
-        ...ALICE,
-        spec: { ...ALICE.spec, isMachineAccount: true },
-      }),
-      { created: false, org: "acme" },
-    );
-    expect(fields(result)["Account Type"]).toBe("Machine Account");
-  });
-});

package/src/commands/bootstrap.test.ts

@@ -1,178 +0,0 @@
-// Command-level contract for `stigmer bootstrap`: against the configured
-// backend it ensures the organization the CLI falls back to (`stigmer`) and
-// installs nothing, so the command creates the organization and renders one
-// Organization section; a second run over a ready backend reports the org
-// present and creates nothing. A real Connect backend over h2c serves the org
-// controllers; the config file (HOME redirected) points a selfhost backend at
-// it.
-
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import {
-  createServer as createHttp2Server,
-  type Http2Server,
-  type ServerHttp2Session,
-} from "node:http2";
-import type { AddressInfo } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { create } from "@bufbuild/protobuf";
-import type { ConnectRouter } from "@connectrpc/connect";
-import { connectNodeAdapter } from "@connectrpc/connect-node";
-import {
-  type Organization,
-  OrganizationSchema,
-} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
-import { OrganizationsSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/io_pb";
-import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
-import {
-  afterAll,
-  afterEach,
-  beforeAll,
-  beforeEach,
-  describe,
-  expect,
-  it,
-  vi,
-} from "vitest";
-import { DEFAULT_LOCAL_ORG } from "../config/index.js";
-import { classify, ExitCode } from "../errors/index.js";
-import { buildProgram } from "../program.js";
-
-let backend: Http2Server;
-let port: number;
-const openSessions = new Set<ServerHttp2Session>();
-
-let orgs: Map<string, Organization>;
-let creates: number;
-
-let home: string;
-let originalHome: string | undefined;
-
-beforeAll(async () => {
-  const routes = (router: ConnectRouter) => {
-    router.service(OrganizationQueryController, {
-      findMyOrganizations: () =>
-        create(OrganizationsSchema, { entries: [...orgs.values()] }),
-    });
-    router.service(OrganizationCommandController, {
-      create: (org) => {
-        creates += 1;
-        const row = create(OrganizationSchema, org);
-        if (row.metadata !== undefined) row.metadata.id = "org_1";
-        orgs.set(row.metadata?.slug ?? "", row);
-        return row;
-      },
-    });
-  };
-  backend = createHttp2Server(connectNodeAdapter({ routes }));
-  backend.on("session", (session) => {
-    openSessions.add(session);
-    session.on("close", () => openSessions.delete(session));
-  });
-  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
-  port = (backend.address() as AddressInfo).port;
-});
-
-afterAll(async () => {
-  for (const session of openSessions) session.destroy();
-  await new Promise<void>((resolve) => backend.close(() => resolve()));
-});
-
-beforeEach(() => {
-  orgs = new Map();
-  creates = 0;
-  originalHome = process.env.HOME;
-  home = mkdtempSync(join(tmpdir(), "stigmer-bootstrap-cmd-"));
-  process.env.HOME = home;
-  mkdirSync(join(home, ".stigmer"), { recursive: true });
-  writeFileSync(
-    join(home, ".stigmer", "config.yaml"),
-    [
-      "backend:",
-      "  type: cloud",
-      "backends:",
-      "  test:",
-      "    type: selfhost",
-      `    endpoint: 127.0.0.1:${port}`,
-      "current_backend: test",
-      "",
-    ].join("\n"),
-  );
-});
-
-afterEach(() => {
-  if (originalHome === undefined) delete process.env.HOME;
-  else process.env.HOME = originalHome;
-  rmSync(home, { recursive: true, force: true });
-});
-
-interface RunOutcome {
-  readonly exitCode: number;
-  readonly message: string;
-  readonly stdout: string;
-}
-
-async function run(...args: string[]): Promise<RunOutcome> {
-  const program = buildProgram();
-  program.exitOverride();
-  let stdout = "";
-  const outSpy = vi
-    .spyOn(process.stdout, "write")
-    .mockImplementation((chunk) => {
-      stdout += String(chunk);
-      return true;
-    });
-  const errSpy = vi.spyOn(process.stderr, "write").mockReturnValue(true);
-  try {
-    await program.parseAsync(["node", "stigmer", "bootstrap", ...args]);
-    return { exitCode: ExitCode.Success, message: "", stdout };
-  } catch (err) {
-    return {
-      exitCode: classify(err)?.exitCode ?? -1,
-      message: err instanceof Error ? err.message : String(err),
-      stdout,
-    };
-  } finally {
-    outSpy.mockRestore();
-    errSpy.mockRestore();
-  }
-}
-
-interface JsonSection {
-  title?: string;
-  fields?: { key: string; value: string }[];
-}
-
-function section(payload: { sections?: JsonSection[] }, title: string) {
-  return payload.sections?.find((s) => s.title === title);
-}
-
-describe("bootstrap", () => {
-  it("creates the organization, installs nothing, and reports it", async () => {
-    const outcome = await run("--json");
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    expect(orgs.has(DEFAULT_LOCAL_ORG)).toBe(true);
-
-    const payload = JSON.parse(outcome.stdout);
-    expect(payload.status).toBe("success");
-    expect(payload.message).toBe("Backend is ready");
-    expect(payload.sections?.map((s: JsonSection) => s.title)).toEqual(["Organization"]);
-    expect(section(payload, "Organization")?.fields).toEqual([
-      { key: "Slug", value: DEFAULT_LOCAL_ORG },
-      { key: "State", value: "created" },
-    ]);
-  });
-
-  it("is a no-op the second time: org present, nothing created", async () => {
-    await run("--json");
-    const outcome = await run("--json");
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    expect(creates).toBe(1);
-    const payload = JSON.parse(outcome.stdout);
-    expect(section(payload, "Organization")?.fields).toContainEqual({
-      key: "State",
-      value: "present",
-    });
-  });
-});

package/src/commands/config/backend.test.ts

@@ -1,122 +0,0 @@
-// Command-level contract for the named-backend surface (O3):
-// add/use/list/remove over the real config file (HOME redirected to a
-// throwaway dir), the reserved-name refusals, and the remove-current guard.
-// The model-level semantics (migration, resolution, credentials) are pinned
-// in config.test.ts / resolve.test.ts — this file pins the command layer's
-// own rules.
-
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { load } from "../../config/index.js";
-import { classify, ExitCode } from "../../errors/index.js";
-import { buildProgram } from "../../program.js";
-
-let home: string;
-let originalHome: string | undefined;
-
-beforeEach(() => {
-  originalHome = process.env.HOME;
-  home = mkdtempSync(join(tmpdir(), "stigmer-backend-cmd-"));
-  process.env.HOME = home;
-});
-
-afterEach(() => {
-  if (originalHome === undefined) delete process.env.HOME;
-  else process.env.HOME = originalHome;
-  rmSync(home, { recursive: true, force: true });
-});
-
-interface RunOutcome {
-  readonly exitCode: number;
-  readonly message: string;
-}
-
-async function run(...args: string[]): Promise<RunOutcome> {
-  const program = buildProgram();
-  program.exitOverride();
-  const outSpy = vi.spyOn(process.stdout, "write").mockReturnValue(true);
-  const errSpy = vi.spyOn(process.stderr, "write").mockReturnValue(true);
-  try {
-    await program.parseAsync(["node", "stigmer", "config", "backend", ...args]);
-    return { exitCode: ExitCode.Success, message: "" };
-  } catch (err) {
-    return {
-      exitCode: classify(err)?.exitCode ?? -1,
-      message: err instanceof Error ? err.message : String(err),
-    };
-  } finally {
-    outSpy.mockRestore();
-    errSpy.mockRestore();
-  }
-}
-
-describe("config backend add/use/list/remove", () => {
-  it("add persists a selfhost entry with its endpoint and api key", async () => {
-    const outcome = await run(
-      "add",
-      "staging",
-      "--endpoint",
-      "stigmer.example.com:7234",
-      "--api-key",
-      "stk_x",
-    );
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    const config = load();
-    expect(config.backends?.["staging"]).toEqual({
-      type: "selfhost",
-      endpoint: "stigmer.example.com:7234",
-      api_key: "stk_x",
-    });
-    // Adding never switches — the user opts in with `use`.
-    expect(config.current_backend).toBe("local");
-  });
-
-  it("add updates an existing entry without dropping its credential", async () => {
-    await run("add", "staging", "--endpoint", "old:7234", "--api-key", "stk_x");
-    await run("add", "staging", "--endpoint", "new:7234");
-    const entry = load().backends?.["staging"];
-    expect(entry?.endpoint).toBe("new:7234");
-    expect(entry?.api_key).toBe("stk_x");
-  });
-
-  it("use switches the current backend; unknown names refuse", async () => {
-    await run("add", "staging", "--endpoint", "host:7234");
-    expect((await run("use", "staging")).exitCode).toBe(ExitCode.Success);
-    expect(load().current_backend).toBe("staging");
-
-    const unknown = await run("use", "nope");
-    expect(unknown.exitCode).toBe(ExitCode.Usage);
-    expect(unknown.message).toContain('unknown backend "nope"');
-  });
-
-  it("the local name is reserved: add and remove refuse it", async () => {
-    const add = await run("add", "local", "--endpoint", "host:7234");
-    expect(add.exitCode).toBe(ExitCode.Usage);
-    const remove = await run("remove", "local");
-    expect(remove.exitCode).toBe(ExitCode.Usage);
-  });
-
-  it("remove refuses the current backend and deletes others", async () => {
-    await run("add", "staging", "--endpoint", "host:7234");
-    await run("use", "staging");
-
-    const current = await run("remove", "staging");
-    expect(current.exitCode).toBe(ExitCode.Usage);
-    expect(current.message).toContain("current backend");
-
-    await run("use", "local");
-    expect((await run("remove", "staging")).exitCode).toBe(ExitCode.Success);
-    expect(load().backends?.["staging"]).toBeUndefined();
-  });
-
-  it("set cloud seeds and selects the reserved cloud entry (legacy sugar)", async () => {
-    expect((await run("set", "cloud")).exitCode).toBe(ExitCode.Success);
-    const config = load();
-    expect(config.current_backend).toBe("cloud");
-    expect(config.backends?.["cloud"]?.endpoint).toBe("api.stigmer.ai:443");
-    expect((await run("set", "local")).exitCode).toBe(ExitCode.Success);
-    expect(load().current_backend).toBe("local");
-  });
-});

package/src/commands/config/context.test.ts

@@ -1,171 +0,0 @@
-// Command-level contract for `stigmer config context set --org`: an
-// organization the caller belongs to on the active backend is persisted as
-// the context and then resolved by every command; a slug the backend does not
-// list among the caller's own is refused as not found and the config file is
-// left byte-for-byte as it was; an empty slug clears the context without
-// asking the backend; no `--org` at all is a usage error. And `context show`
-// names the active backend, not the legacy local/cloud switch the file also
-// carries. A real Connect backend over h2c serves findMyOrganizations; the
-// config file (HOME redirected) points a selfhost backend at it.
-
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import {
-  createServer as createHttp2Server,
-  type Http2Server,
-  type ServerHttp2Session,
-} from "node:http2";
-import type { AddressInfo } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { create } from "@bufbuild/protobuf";
-import type { ConnectRouter } from "@connectrpc/connect";
-import { connectNodeAdapter } from "@connectrpc/connect-node";
-import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-import { OrganizationsSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/io_pb";
-import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
-import { load, resolveOrganization } from "../../config/index.js";
-import { classify, ExitCode } from "../../errors/index.js";
-import { buildProgram } from "../../program.js";
-
-let backend: Http2Server;
-let port: number;
-const openSessions = new Set<ServerHttp2Session>();
-let lookups: number;
-
-let home: string;
-let originalHome: string | undefined;
-
-beforeAll(async () => {
-  const routes = (router: ConnectRouter) => {
-    router.service(OrganizationQueryController, {
-      findMyOrganizations: () => {
-        lookups += 1;
-        return create(OrganizationsSchema, {
-          entries: [create(OrganizationSchema, { metadata: { id: "acme", slug: "acme" } })],
-        });
-      },
-    });
-  };
-  backend = createHttp2Server(connectNodeAdapter({ routes }));
-  backend.on("session", (session) => {
-    openSessions.add(session);
-    session.on("close", () => openSessions.delete(session));
-  });
-  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
-  port = (backend.address() as AddressInfo).port;
-});
-
-afterAll(async () => {
-  for (const session of openSessions) session.destroy();
-  await new Promise<void>((resolve) => backend.close(() => resolve()));
-});
-
-beforeEach(() => {
-  lookups = 0;
-  originalHome = process.env.HOME;
-  home = mkdtempSync(join(tmpdir(), "stigmer-context-cmd-"));
-  process.env.HOME = home;
-  mkdirSync(join(home, ".stigmer"), { recursive: true });
-  writeFileSync(
-    configFile(),
-    [
-      "backend:",
-      "  type: cloud",
-      "backends:",
-      "  team:",
-      "    type: selfhost",
-      `    endpoint: 127.0.0.1:${port}`,
-      "current_backend: team",
-      "",
-    ].join("\n"),
-  );
-});
-
-afterEach(() => {
-  if (originalHome === undefined) delete process.env.HOME;
-  else process.env.HOME = originalHome;
-  rmSync(home, { recursive: true, force: true });
-});
-
-function configFile(): string {
-  return join(home, ".stigmer", "config.yaml");
-}
-
-interface RunOutcome {
-  readonly exitCode: number;
-  readonly message: string;
-  readonly stdout: string;
-}
-
-async function run(...args: string[]): Promise<RunOutcome> {
-  return runContext("set", ...args);
-}
-
-async function runContext(...args: string[]): Promise<RunOutcome> {
-  const program = buildProgram();
-  program.exitOverride();
-  let stdout = "";
-  const outSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk) => {
-    stdout += String(chunk);
-    return true;
-  });
-  const errSpy = vi.spyOn(process.stderr, "write").mockReturnValue(true);
-  try {
-    await program.parseAsync(["node", "stigmer", "config", "context", ...args]);
-    return { exitCode: ExitCode.Success, message: "", stdout };
-  } catch (err) {
-    return {
-      exitCode: classify(err)?.exitCode ?? -1,
-      message: err instanceof Error ? err.message : String(err),
-      stdout,
-    };
-  } finally {
-    outSpy.mockRestore();
-    errSpy.mockRestore();
-  }
-}
-
-describe("config context set --org", () => {
-  it("persists an organization the caller belongs to, which every command then resolves", async () => {
-    const outcome = await run("--org", "acme");
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    expect(lookups).toBe(1);
-    expect(resolveOrganization(load())).toBe("acme");
-  });
-
-  it("refuses a slug the backend does not list as the caller's and leaves the config untouched", async () => {
-    const before = readFileSync(configFile(), "utf8");
-    const outcome = await run("--org", "acmee");
-    expect(outcome.exitCode).toBe(ExitCode.NotFound);
-    expect(outcome.message).toMatch(/organization 'acmee' is not one you belong to on the 'team' backend/);
-    expect(readFileSync(configFile(), "utf8")).toBe(before);
-  });
-
-  it("clears the context with an empty slug, without asking the backend", async () => {
-    await run("--org", "acme");
-    const outcome = await run("--org", "");
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    expect(lookups).toBe(1);
-    expect(resolveOrganization(load())).toBe("stigmer");
-  });
-
-  it("is a usage error without --org", async () => {
-    const outcome = await run();
-    expect(outcome.exitCode).toBe(ExitCode.Usage);
-    expect(outcome.message).toMatch(/--org is required/);
-  });
-});
-
-describe("config context show", () => {
-  it("names the active backend, not the legacy local/cloud switch", async () => {
-    await run("--org", "acme");
-    const outcome = await runContext("show", "--json");
-    expect(outcome.exitCode).toBe(ExitCode.Success);
-    const fields = JSON.parse(outcome.stdout).sections[0].fields as { key: string; value: string }[];
-    expect(fields).toEqual([
-      { key: "Organization", value: "acme" },
-      { key: "Backend", value: "team" },
-    ]);
-  });
-});

package/src/commands/connect.test.ts

@@ -1,113 +0,0 @@
-// Command-level contract for the `connect mcp-server` org guard (issue #140).
-//
-// Connecting pushes to the backend, which requires an org. Rather than let the
-// backend reject the request with the cryptic "org value length must be at least
-// 1" validation error, the command fails fast with actionable guidance — but
-// only when it is actually going to push. `--dry-run` discovers locally and must
-// stay usable with no org configured.
-//
-// Local mode always resolves an org (the single-tenant DEFAULT_LOCAL_ORG
-// fallback in resolveOrganization), so the guard can only fire in cloud mode
-// with no org selected. The guard test injects that shape by overriding
-// `load()`; everything else stays real. The guard runs before any network
-// call, so both cases are fully deterministic and offline.
-
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { Config } from "../config/index.js";
-import { classify, ExitCode } from "../errors/index.js";
-import { buildProgram } from "../program.js";
-
-// When set, `load()` returns this config instead of reading disk/defaults.
-// Reset in beforeEach so each test opts in explicitly.
-let configOverride: Config | undefined;
-
-vi.mock("../config/index.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("../config/index.js")>();
-  return {
-    ...actual,
-    load: (path?: string) => configOverride ?? actual.load(path),
-  };
-});
-
-/** An authenticated cloud config with no org selected — the guard's target shape. */
-function cloudConfigWithoutOrg(): Config {
-  return {
-    backend: { type: "cloud" },
-    backends: { cloud: { type: "cloud", token: "test-token" } },
-    current_backend: "cloud",
-  };
-}
-
-interface RunOutcome {
-  readonly exitCode: number;
-  readonly message: string;
-}
-
-// Runs `connect mcp-server <ref> [flags]` in standalone mode with output
-// suppressed, returning the thrown error's classified exit code and message (or
-// a success sentinel). `--standalone` is a program-global flag, so it must
-// precede the subcommand (commander's enablePositionalOptions).
-async function runConnect(
-  ref: string,
-  ...flags: string[]
-): Promise<RunOutcome> {
-  const program = buildProgram();
-  program.exitOverride();
-  const outSpy = vi.spyOn(process.stdout, "write").mockReturnValue(true);
-  const errSpy = vi.spyOn(process.stderr, "write").mockReturnValue(true);
-  try {
-    await program.parseAsync([
-      "node",
-      "stigmer",
-      "--standalone",
-      "connect",
-      "mcp-server",
-      ref,
-      ...flags,
-    ]);
-    return { exitCode: ExitCode.Success, message: "" };
-  } catch (err) {
-    return {
-      exitCode: classify(err)?.exitCode ?? -1,
-      message: err instanceof Error ? err.message : String(err),
-    };
-  } finally {
-    outSpy.mockRestore();
-    errSpy.mockRestore();
-  }
-}
-
-let savedOrg: string | undefined;
-let savedApiKey: string | undefined;
-
-beforeEach(() => {
-  configOverride = undefined;
-  savedOrg = process.env.STIGMER_ORG_ID;
-  savedApiKey = process.env.STIGMER_API_KEY;
-  delete process.env.STIGMER_ORG_ID;
-  delete process.env.STIGMER_API_KEY;
-});
-
-afterEach(() => {
-  if (savedOrg === undefined) delete process.env.STIGMER_ORG_ID;
-  else process.env.STIGMER_ORG_ID = savedOrg;
-  if (savedApiKey === undefined) delete process.env.STIGMER_API_KEY;
-  else process.env.STIGMER_API_KEY = savedApiKey;
-});
-
-describe("connect mcp-server org guard", () => {
-  it("fails fast with actionable guidance when cloud mode has no org (non-dry-run)", async () => {
-    configOverride = cloudConfigWithoutOrg();
-    const outcome = await runConnect("mcp_test");
-    expect(outcome.message).toContain("organization not set");
-    expect(outcome.exitCode).toBe(ExitCode.Usage);
-  });
-
-  it("does not apply the org guard in dry-run mode (offline dry-run stays usable)", async () => {
-    // Dry-run skips the push, so the guard must not fire even with no org. The
-    // command proceeds past the guard and fails later for an unrelated reason
-    // (no reachable backend) — never with the org guidance error.
-    const outcome = await runConnect("mcp_test", "--dry-run");
-    expect(outcome.message).not.toContain("organization not set");
-  });
-});