@vellumai/assistant 0.6.3 → 0.6.4

package/src/__tests__/mock-gateway-ipc.ts

@@ -0,0 +1,151 @@
+/**
+ * Global test utility for mocking gateway IPC calls via `node:net`.
+ *
+ * Usage:
+ *   import { mockGatewayIpc, resetMockGatewayIpc } from "../__tests__/mock-gateway-ipc.js";
+ *
+ *   beforeEach(() => resetMockGatewayIpc());
+ *   afterEach(() => resetMockGatewayIpc());
+ *
+ *   it("uses IPC flags", async () => {
+ *     mockGatewayIpc({ "my-flag": true });
+ *     await initFeatureFlagOverrides();
+ *     ...
+ *   });
+ *
+ *   it("simulates socket error", async () => {
+ *     mockGatewayIpc(null, { error: true, code: "ENOENT" });
+ *     ...
+ *   });
+ *
+ * The mock is registered in the test preload (test-preload.ts) so every test
+ * file gets a no-op IPC layer by default — no test accidentally connects to
+ * a real gateway socket. Call `mockGatewayIpc()` to configure specific
+ * responses when the test cares about the IPC result.
+ *
+ * Mocks `node:net` at the socket level, but ONLY intercepts connections to
+ * `gateway.sock` paths. All other `node:net` exports and non-gateway
+ * `connect()` calls pass through to the real implementation so that proxy /
+ * tunnel tests continue to work.
+ */
+
+import { EventEmitter } from "node:events";
+import { mock } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Configurable state
+// ---------------------------------------------------------------------------
+
+/** IPC result the fake gateway will return (keyed by method name). */
+let ipcResults: Record<string, unknown> = {};
+
+/** Whether the fake socket should simulate a connection error. */
+let simulateError = false;
+
+/** Error code to use when simulating an error. */
+let simulateErrorCode = "ENOENT";
+
+// ---------------------------------------------------------------------------
+// FakeSocket — simulates the gateway IPC protocol
+// ---------------------------------------------------------------------------
+
+class FakeSocket extends EventEmitter {
+  unref() {
+    /* no-op */
+  }
+  destroy() {
+    /* no-op */
+  }
+  write(data: string) {
+    try {
+      const req = JSON.parse(data.trim());
+      const result =
+        req.method in ipcResults ? ipcResults[req.method] : undefined;
+      const response = JSON.stringify({ id: req.id, result });
+      queueMicrotask(() => {
+        this.emit("data", Buffer.from(response + "\n"));
+      });
+    } catch {
+      // Malformed request — ignore
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Register the mock (called once from test-preload.ts)
+// ---------------------------------------------------------------------------
+
+export function installGatewayIpcMock(): void {
+  // Snapshot the real node:net exports BEFORE mock.module replaces them.
+  // require() returns the current (real) module synchronously; after
+  // mock.module() the namespace is replaced for all future importers
+  // (like gateway-client.ts), but our captured references stay real.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports -- require() is intentional: we need a synchronous snapshot of the real module before mock.module() replaces it
+  const realNet = require("node:net") as typeof import("node:net");
+  const realConnect = realNet.connect;
+
+  mock.module("node:net", () => ({
+    ...realNet,
+    connect(...args: unknown[]) {
+      // Only intercept Unix domain socket connections to gateway.sock.
+      // Everything else (TCP ports, other Unix sockets) passes through
+      // to the real node:net so proxy / tunnel tests keep working.
+      if (
+        typeof args[0] === "string" &&
+        (args[0] as string).endsWith("gateway.sock")
+      ) {
+        const socket = new FakeSocket();
+        queueMicrotask(() => {
+          if (simulateError) {
+            const err = new Error(simulateErrorCode) as NodeJS.ErrnoException;
+            err.code = simulateErrorCode;
+            socket.emit("error", err);
+            socket.emit("close");
+          } else {
+            socket.emit("connect");
+          }
+        });
+        return socket;
+      }
+      return realConnect(...(args as Parameters<typeof realConnect>));
+    },
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// Public API for tests
+// ---------------------------------------------------------------------------
+
+/**
+ * Configure the fake gateway IPC response.
+ *
+ * @param flags — feature flag map returned by `get_feature_flags`. Pass
+ *   `null` to skip setting a result (useful when only simulating errors).
+ * @param opts.error — simulate a socket connection error
+ * @param opts.code — error code (default "ENOENT")
+ * @param opts.results — raw method→result map for arbitrary IPC methods
+ */
+export function mockGatewayIpc(
+  flags?: Record<string, boolean> | null,
+  opts?: { error?: boolean; code?: string; results?: Record<string, unknown> },
+): void {
+  if (flags != null) {
+    ipcResults["get_feature_flags"] = flags;
+  }
+  if (opts?.results) {
+    Object.assign(ipcResults, opts.results);
+  }
+  if (opts?.error) {
+    simulateError = true;
+    simulateErrorCode = opts.code ?? "ENOENT";
+  }
+}
+
+/**
+ * Reset all IPC mock state back to defaults (empty flags, no errors).
+ */
+export function resetMockGatewayIpc(): void {
+  ipcResults = {};
+  simulateError = false;
+  simulateErrorCode = "ENOENT";
+}

package/src/__tests__/model-intents.test.ts

@@ -59,7 +59,7 @@ describe("model intents", () => {
       "claude-haiku-4-5-20251001",
     );
     expect(resolveModelIntent("anthropic", "quality-optimized")).toBe(
-      "claude-opus-4-6",
+      "claude-opus-4-7",
     );
     expect(resolveModelIntent("anthropic", "vision-optimized")).toBe(
       "claude-opus-4-6",
@@ -94,7 +94,7 @@ describe("RetryProvider model intent normalization", () => {
     });
 
     const config = seen?.config as Record<string, unknown>;
-    expect(config.model).toBe("claude-opus-4-6");
+    expect(config.model).toBe("claude-opus-4-7");
     expect(config.modelIntent).toBeUndefined();
     expect(config.max_tokens).toBe(123);
   });

package/src/__tests__/oauth-apps-routes.test.ts

@@ -52,6 +52,7 @@ mock.module("../oauth/oauth-store.js", () => ({
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           refreshUrl: null,
           tokenEndpointAuthMethod: "client_secret_post",
+          tokenExchangeBodyFormat: "form",
           userinfoUrl: null,
           baseUrl: null,
           defaultScopes: "[]",

package/src/__tests__/oauth-cli.test.ts

@@ -173,6 +173,8 @@ mock.module("../oauth/oauth-store.js", () => ({
       tokenEndpointAuthMethod:
         (params.tokenEndpointAuthMethod as string | undefined) ||
         "client_secret_post",
+      tokenExchangeBodyFormat:
+        (params.tokenExchangeBodyFormat as string | undefined) ?? "form",
       userinfoUrl: params.userinfoUrl ?? null,
       baseUrl: params.baseUrl ?? null,
       defaultScopes: JSON.stringify(params.defaultScopes ?? []),

package/src/__tests__/oauth-connect-orchestrator.test.ts

@@ -91,6 +91,7 @@ type ProviderRow = {
   tokenExchangeUrl: string;
   refreshUrl: string | null;
   tokenEndpointAuthMethod: string;
+  tokenExchangeBodyFormat: string;
   userinfoUrl: string | null;
   baseUrl: string | null;
   defaultScopes: string;
@@ -169,6 +170,7 @@ function makeProviderRow(
     tokenExchangeUrl: "https://provider.example.com/token",
     refreshUrl: null,
     tokenEndpointAuthMethod: "client_secret_post",
+    tokenExchangeBodyFormat: "form",
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: '["openid","email"]',

package/src/__tests__/oauth-provider-serializer.test.ts

@@ -15,6 +15,7 @@ function makeRow(overrides: Partial<OAuthProviderRow> = {}): OAuthProviderRow {
     tokenExchangeUrl: "https://auth.example.com/token",
     refreshUrl: null,
     tokenEndpointAuthMethod: "client_secret_post",
+    tokenExchangeBodyFormat: "form",
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",

package/src/__tests__/oauth-providers-routes.test.ts

@@ -14,6 +14,7 @@ const mockListProviders = mock(() => [
     tokenExchangeUrl: "https://oauth2.googleapis.com/token",
     refreshUrl: null,
     tokenEndpointAuthMethod: "client_secret_post",
+    tokenExchangeBodyFormat: "form",
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
@@ -55,6 +56,7 @@ const mockListProviders = mock(() => [
     tokenExchangeUrl: "https://github.com/login/oauth/access_token",
     refreshUrl: null,
     tokenEndpointAuthMethod: "client_secret_post",
+    tokenExchangeBodyFormat: "form",
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",

package/src/__tests__/oauth-store.test.ts

@@ -592,6 +592,38 @@ describe("provider operations", () => {
       expect(row!.tokenEndpointAuthMethod).toBe("client_secret_post");
     });
 
+    test("defaults tokenExchangeBodyFormat to 'form' when omitted from seed", () => {
+      seedProviders([
+        {
+          provider: "no-body-format-provider",
+          authorizeUrl: "https://example.com/authorize",
+          tokenExchangeUrl: "https://example.com/token",
+          defaultScopes: [],
+          scopePolicy: {},
+          // Note: tokenExchangeBodyFormat intentionally omitted
+        },
+      ]);
+      const row = getProvider("no-body-format-provider");
+      expect(row).toBeDefined();
+      expect(row!.tokenExchangeBodyFormat).toBe("form");
+    });
+
+    test("persists explicit tokenExchangeBodyFormat value on seed", () => {
+      seedProviders([
+        {
+          provider: "json-body-format-provider",
+          authorizeUrl: "https://example.com/authorize",
+          tokenExchangeUrl: "https://example.com/token",
+          defaultScopes: [],
+          scopePolicy: {},
+          tokenExchangeBodyFormat: "json",
+        },
+      ]);
+      const row = getProvider("json-body-format-provider");
+      expect(row).toBeDefined();
+      expect(row!.tokenExchangeBodyFormat).toBe("json");
+    });
+
     test("migration 216 backfills NULL token_endpoint_auth_method to client_secret_post", () => {
       // Use raw SQLite to bypass Drizzle's NOT NULL enforcement and insert
       // a legacy-shaped row with NULL token_endpoint_auth_method.
@@ -813,6 +845,33 @@ describe("provider operations", () => {
       expect(row.tokenEndpointAuthMethod).toBe("client_secret_basic");
     });
 
+    test("defaults tokenExchangeBodyFormat to 'form' when omitted", () => {
+      const row = registerProvider({
+        provider: "no-body-format-test",
+        authorizeUrl: "https://example.com/authorize",
+        tokenExchangeUrl: "https://example.com/token",
+        defaultScopes: [],
+        scopePolicy: {},
+        // Note: tokenExchangeBodyFormat intentionally omitted
+      });
+      expect(row.tokenExchangeBodyFormat).toBe("form");
+
+      const fetched = getProvider("no-body-format-test");
+      expect(fetched!.tokenExchangeBodyFormat).toBe("form");
+    });
+
+    test("persists explicit tokenExchangeBodyFormat 'json' when registering a provider", () => {
+      const row = registerProvider({
+        provider: "json-body-format-test",
+        authorizeUrl: "https://example.com/authorize",
+        tokenExchangeUrl: "https://example.com/token",
+        defaultScopes: [],
+        scopePolicy: {},
+        tokenExchangeBodyFormat: "json",
+      });
+      expect(row.tokenExchangeBodyFormat).toBe("json");
+    });
+
     test("stores logoUrl when provided", () => {
       registerProvider({
         provider: "notion",
@@ -1059,6 +1118,32 @@ describe("provider operations", () => {
       expect(row!.tokenEndpointAuthMethod).toBe("client_secret_post");
     });
 
+    test("coerces empty string tokenExchangeBodyFormat to 'form'", () => {
+      seedProviders([
+        {
+          provider: "update-empty-body-format-test",
+          authorizeUrl: "https://example.com/authorize",
+          tokenExchangeUrl: "https://example.com/token",
+          tokenExchangeBodyFormat: "json",
+          defaultScopes: [],
+          scopePolicy: {},
+        },
+      ]);
+
+      expect(
+        getProvider("update-empty-body-format-test")!.tokenExchangeBodyFormat,
+      ).toBe("json");
+
+      const updated = updateProvider("update-empty-body-format-test", {
+        tokenExchangeBodyFormat: "",
+      });
+      expect(updated).toBeDefined();
+      expect(updated!.tokenExchangeBodyFormat).toBe("form");
+
+      const row = getProvider("update-empty-body-format-test");
+      expect(row!.tokenExchangeBodyFormat).toBe("form");
+    });
+
     test("sets logoUrl on an existing row where it was previously null", () => {
       registerProvider({
         provider: "linear",

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -83,6 +83,7 @@ mock.module("../inbound/platform-callback-registration.js", () => ({
 // Track token exchange request
 let lastTokenRequestBody: URLSearchParams | null = null;
 let lastTokenRequestHeaders: Record<string, string> = {};
+let lastTokenRequestRawBody: string | null = null;
 
 // Mock fetch for token exchange
 let mockTokenResponse: {
@@ -112,7 +113,12 @@ globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
   if (url.includes("token")) {
     // Capture request body and headers for assertions
     if (init?.body) {
-      lastTokenRequestBody = new URLSearchParams(init.body as string);
+      lastTokenRequestRawBody = String(init.body);
+      try {
+        lastTokenRequestBody = new URLSearchParams(init.body as string);
+      } catch {
+        lastTokenRequestBody = null;
+      }
     }
     if (init?.headers) {
       lastTokenRequestHeaders = init.headers as Record<string, string>;
@@ -135,7 +141,11 @@ globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
 // Import module under test AFTER mocks are in place
 // ---------------------------------------------------------------------------
 
-import { type OAuth2Config, startOAuth2Flow } from "../security/oauth2.js";
+import {
+  type OAuth2Config,
+  refreshOAuth2Token,
+  startOAuth2Flow,
+} from "../security/oauth2.js";
 
 const BASE_OAUTH_CONFIG: OAuth2Config = {
   authorizeUrl: "https://provider.example.com/authorize",
@@ -151,6 +161,7 @@ beforeEach(() => {
   pendingCallbacks.clear();
   lastTokenRequestBody = null;
   lastTokenRequestHeaders = {};
+  lastTokenRequestRawBody = null;
   mockTokenResponse = {
     ok: true,
     status: 200,
@@ -204,15 +215,19 @@ describe("OAuth2 gateway transport", () => {
     test("falls back to loopback transport when ingress.publicBaseUrl is not configured", async () => {
       mockPublicBaseUrl = "";
 
-      let capturedAuthUrl = "";
+      let resolveOpenUrl!: (url: string) => void;
+      const openUrlPromise = new Promise<string>((resolve) => {
+        resolveOpenUrl = resolve;
+      });
       const flowPromise = startOAuth2Flow(BASE_OAUTH_CONFIG, {
         openUrl: (url) => {
-          capturedAuthUrl = url;
+          resolveOpenUrl(url);
         },
       });
 
-      // Give the loopback server time to start
-      await new Promise((r) => setTimeout(r, 50));
+      // Wait for the loopback server to bind and build the auth URL.
+      // Awaiting the openUrl callback instead of a fixed timer avoids CI-load flakes.
+      const capturedAuthUrl = await openUrlPromise;
 
       // Auth URL should use a localhost redirect_uri
       expect(capturedAuthUrl).toContain("redirect_uri=");
@@ -844,4 +859,232 @@ describe("OAuth2 gateway transport", () => {
       expect(result.grantedScopes).toEqual(["read", "write", "admin"]);
     });
   });
+
+  describe("tokenExchangeBodyFormat", () => {
+    test("sends JSON body when tokenExchangeBodyFormat is 'json'", async () => {
+      mockPublicBaseUrl = "https://gw.example.com";
+
+      const jsonConfig: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        clientSecret: "test-client-secret",
+        tokenExchangeBodyFormat: "json",
+      };
+
+      const flowPromise = startOAuth2Flow(
+        jsonConfig,
+        { openUrl: () => {} },
+        { callbackTransport: "gateway" },
+      );
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve("json-body-code");
+
+      await flowPromise;
+
+      // Content-Type should be application/json
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe("application/json");
+
+      // Body should be valid JSON
+      expect(lastTokenRequestRawBody).not.toBeNull();
+      const parsed = JSON.parse(lastTokenRequestRawBody!);
+      expect(parsed.grant_type).toBe("authorization_code");
+      expect(parsed.client_id).toBe("test-client-id");
+      expect(parsed.client_secret).toBe("test-client-secret");
+      expect(parsed.code).toBe("json-body-code");
+      expect(parsed.code_verifier).toBeTruthy();
+    });
+
+    test("sends form-encoded body by default (tokenExchangeBodyFormat omitted)", async () => {
+      mockPublicBaseUrl = "https://gw.example.com";
+
+      const flowPromise = startOAuth2Flow(
+        BASE_OAUTH_CONFIG,
+        { openUrl: () => {} },
+        { callbackTransport: "gateway" },
+      );
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve("form-body-code");
+
+      await flowPromise;
+
+      // Content-Type should be form-encoded
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe(
+        "application/x-www-form-urlencoded",
+      );
+
+      // Body should be parseable as URLSearchParams
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get("grant_type")).toBe(
+        "authorization_code",
+      );
+      expect(lastTokenRequestBody!.get("client_id")).toBe("test-client-id");
+    });
+
+    test("sends form-encoded body when tokenExchangeBodyFormat is explicitly 'form'", async () => {
+      mockPublicBaseUrl = "https://gw.example.com";
+
+      const formConfig: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        tokenExchangeBodyFormat: "form",
+      };
+
+      const flowPromise = startOAuth2Flow(
+        formConfig,
+        { openUrl: () => {} },
+        { callbackTransport: "gateway" },
+      );
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve("explicit-form-code");
+
+      await flowPromise;
+
+      // Content-Type should be form-encoded
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe(
+        "application/x-www-form-urlencoded",
+      );
+
+      // Body should be parseable as URLSearchParams
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get("grant_type")).toBe(
+        "authorization_code",
+      );
+    });
+
+    test("JSON body format works with client_secret_basic auth method", async () => {
+      mockPublicBaseUrl = "https://gw.example.com";
+
+      const jsonBasicConfig: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        clientSecret: "test-client-secret",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        tokenExchangeBodyFormat: "json",
+      };
+
+      const flowPromise = startOAuth2Flow(
+        jsonBasicConfig,
+        { openUrl: () => {} },
+        { callbackTransport: "gateway" },
+      );
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve("json-basic-code");
+
+      await flowPromise;
+
+      // Content-Type should be application/json
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe("application/json");
+
+      // Should have Basic Auth header
+      const expectedCredentials = Buffer.from(
+        "test-client-id:test-client-secret",
+      ).toString("base64");
+      expect(lastTokenRequestHeaders["Authorization"]).toBe(
+        `Basic ${expectedCredentials}`,
+      );
+
+      // Body should be valid JSON without client_id/client_secret
+      const parsed = JSON.parse(lastTokenRequestRawBody!);
+      expect(parsed.grant_type).toBe("authorization_code");
+      expect(parsed.client_id).toBeUndefined();
+      expect(parsed.client_secret).toBeUndefined();
+      expect(parsed.code_verifier).toBeTruthy();
+    });
+  });
+
+  describe("refreshOAuth2Token", () => {
+    test("sends JSON body when tokenExchangeBodyFormat is 'json'", async () => {
+      const result = await refreshOAuth2Token(
+        "https://provider.example.com/token",
+        "test-client-id",
+        "test-refresh-token",
+        "test-client-secret",
+        undefined, // tokenEndpointAuthMethod defaults to client_secret_post
+        "json",
+      );
+
+      // Content-Type should be application/json
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe("application/json");
+
+      // Body should be valid JSON with refresh_token grant
+      expect(lastTokenRequestRawBody).not.toBeNull();
+      const parsed = JSON.parse(lastTokenRequestRawBody!);
+      expect(parsed.grant_type).toBe("refresh_token");
+      expect(parsed.refresh_token).toBe("test-refresh-token");
+      expect(parsed.client_id).toBe("test-client-id");
+      expect(parsed.client_secret).toBe("test-client-secret");
+
+      // Result should contain the tokens
+      expect(result.accessToken).toBe("test-access-token");
+      expect(result.refreshToken).toBe("test-refresh-token");
+    });
+
+    test("sends form-encoded body by default", async () => {
+      const result = await refreshOAuth2Token(
+        "https://provider.example.com/token",
+        "test-client-id",
+        "test-refresh-token",
+        "test-client-secret",
+      );
+
+      // Content-Type should be form-encoded
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe(
+        "application/x-www-form-urlencoded",
+      );
+
+      // Body should be parseable as URLSearchParams
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get("grant_type")).toBe("refresh_token");
+      expect(lastTokenRequestBody!.get("refresh_token")).toBe(
+        "test-refresh-token",
+      );
+      expect(lastTokenRequestBody!.get("client_id")).toBe("test-client-id");
+      expect(lastTokenRequestBody!.get("client_secret")).toBe(
+        "test-client-secret",
+      );
+
+      expect(result.accessToken).toBe("test-access-token");
+    });
+
+    test("JSON body format works with client_secret_basic auth method", async () => {
+      const result = await refreshOAuth2Token(
+        "https://provider.example.com/token",
+        "test-client-id",
+        "test-refresh-token",
+        "test-client-secret",
+        "client_secret_basic",
+        "json",
+      );
+
+      // Content-Type should be application/json
+      expect(lastTokenRequestHeaders["Content-Type"]).toBe("application/json");
+
+      // Should have Basic Auth header
+      const expectedCredentials = Buffer.from(
+        "test-client-id:test-client-secret",
+      ).toString("base64");
+      expect(lastTokenRequestHeaders["Authorization"]).toBe(
+        `Basic ${expectedCredentials}`,
+      );
+
+      // Body should be valid JSON without client_id/client_secret (basic auth puts them in header)
+      expect(lastTokenRequestRawBody).not.toBeNull();
+      const parsed = JSON.parse(lastTokenRequestRawBody!);
+      expect(parsed.grant_type).toBe("refresh_token");
+      expect(parsed.refresh_token).toBe("test-refresh-token");
+      expect(parsed.client_id).toBeUndefined();
+      expect(parsed.client_secret).toBeUndefined();
+
+      expect(result.accessToken).toBe("test-access-token");
+    });
+  });
 });

package/src/__tests__/onboarding-template-contract.test.ts

@@ -9,7 +9,6 @@ const bootstrapRef = readFileSync(
   "utf-8",
 );
 const identity = readFileSync(join(templatesDir, "IDENTITY.md"), "utf-8");
-const user = readFileSync(join(templatesDir, "USER.md"), "utf-8");
 
 describe("onboarding template contracts", () => {
   describe("BOOTSTRAP.md", () => {
@@ -49,10 +48,10 @@ describe("onboarding template contracts", () => {
       expect(lower).toContain("declined");
     });
 
-    test("instructs saving to IDENTITY.md, USER.md, and SOUL.md via file_edit", () => {
+    test("instructs saving to IDENTITY.md, SOUL.md, and user persona file via file_edit", () => {
       expect(bootstrap).toContain("IDENTITY.md");
-      expect(bootstrap).toContain("USER.md");
       expect(bootstrap).toContain("SOUL.md");
+      expect(bootstrap).toContain("{{USER_PERSONA_FILE}}");
       expect(bootstrap).toContain("file_edit");
     });
 
@@ -165,14 +164,8 @@ describe("onboarding template contracts", () => {
     });
   });
 
-  describe("USER.md", () => {
-    test("contains profile fields", () => {
-      expect(user).toContain("Preferred name/reference:");
-      expect(user).toContain("Goals:");
-      expect(user).toContain("Locale:");
-      expect(user).toContain("Work role:");
-      expect(user).toContain("Hobbies/fun:");
-      expect(user).toContain("Daily tools:");
-    });
-  });
+  // Legacy `templates/USER.md` was removed by workspace migration
+  // `031-drop-user-md`. Guardian persona content is now seeded via
+  // `GUARDIAN_PERSONA_TEMPLATE` in `prompts/persona-resolver.ts` and
+  // lives on disk at `users/<slug>.md`.
 });