@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/cli/tests/asset-migration.service.test.ts

@@ -0,0 +1,349 @@
+/**
+ * `cloudpit migrate-assets` criterion file.
+ *
+ * Five arms drive the real command service against temp-home fixtures:
+ * dry-run writes nothing, rewrite is idempotent, conflicts are never
+ * overwritten, a failed path write rolls back to the pre-run bytes, and
+ * provider transcript references are reported as unrewritable.
+ *
+ * Run directly:
+ *   npx tsx --tsconfig server/tsconfig.json --test server/modules/cli/tests/asset-migration.service.test.ts
+ */
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import Database from 'better-sqlite3';
+
+import {
+  createNodeAssetMigrationFileSystem,
+} from '../asset-migration-files.js';
+import {
+  createAssetMigrationService,
+} from '../asset-migration.service.js';
+import type { AssetMigrationReport } from '../asset-migration-report.js';
+import {
+  createAppAssetPathStore,
+  type AssetPathStore,
+} from '../asset-migration-store.js';
+
+type TestContext = { after(callback: () => void): void };
+
+type Fixture = {
+  root: string;
+  homeDir: string;
+  legacyRoot: string;
+  newRoot: string;
+  databasePath: string;
+  settingsPath: string;
+};
+
+function createFixture(t: TestContext): Fixture {
+  const root = mkdtempSync(path.join(os.tmpdir(), 'cloudpit-migrate-assets-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const homeDir = path.join(root, 'home');
+  const legacyRoot = path.join(homeDir, '.cloudcli', 'assets');
+  const newRoot = path.join(homeDir, '.cloudpit', 'assets');
+  mkdirSync(legacyRoot, { recursive: true });
+  return {
+    root,
+    homeDir,
+    legacyRoot,
+    newRoot,
+    databasePath: path.join(homeDir, '.cloudpit', 'auth.db'),
+    settingsPath: path.join(homeDir, '.config', 'cloudpit', 'server.settings.json'),
+  };
+}
+
+function writeFileWithDirectories(filePath: string, content: string): void {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, content, 'utf8');
+}
+
+/** Every path under `root` with directories marked and files hashed. */
+function snapshotTree(root: string): Record<string, string> {
+  const snapshot: Record<string, string> = {};
+  const walk = (directoryPath: string): void => {
+    if (!existsSync(directoryPath)) return;
+    for (const entryName of readdirSync(directoryPath)) {
+      const entryPath = path.join(directoryPath, entryName);
+      const relativePath = path.relative(root, entryPath).split(path.sep).join('/');
+      if (statSync(entryPath).isDirectory()) {
+        snapshot[`${relativePath}/`] = 'directory';
+        walk(entryPath);
+      } else {
+        snapshot[relativePath] = createHash('sha256')
+          .update(readFileSync(entryPath))
+          .digest('hex');
+      }
+    }
+  };
+  walk(root);
+  return snapshot;
+}
+
+function createOutput(): {
+  output: { log(message?: string): void; error(message?: string): void };
+  logMessages: string[];
+  errorMessages: string[];
+} {
+  const logMessages: string[] = [];
+  const errorMessages: string[] = [];
+  return {
+    output: {
+      log: (message = '') => logMessages.push(message),
+      error: (message = '') => errorMessages.push(message),
+    },
+    logMessages,
+    errorMessages,
+  };
+}
+
+function readJsonReport(logMessages: string[]): AssetMigrationReport {
+  const rawReport = logMessages.find((message) => message.trimStart().startsWith('{'));
+  assert.ok(rawReport, `no JSON report in output: ${logMessages.join('\n')}`);
+  return JSON.parse(rawReport) as AssetMigrationReport;
+}
+
+function createStore(fixture: Fixture): AssetPathStore {
+  return createAppAssetPathStore({
+    databasePath: fixture.databasePath,
+    jsonFilePaths: [fixture.settingsPath],
+    now: () => new Date(2026, 10, 3, 12, 0, 0),
+  });
+}
+
+function createService(
+  fixture: Fixture,
+  pathStore: AssetPathStore,
+  capture = createOutput(),
+) {
+  return {
+    capture,
+    service: createAssetMigrationService({
+      environment: {},
+      homeDirectory: fixture.homeDir,
+      fileSystem: createNodeAssetMigrationFileSystem(),
+      pathStore,
+      output: capture.output,
+    }),
+  };
+}
+
+/** Seeds one SQLite row and one JSON document that both embed `legacyRoot`. */
+function seedPersistedPaths(fixture: Fixture): { imagePath: string } {
+  const imagePath = path.join(fixture.legacyRoot, 'photo.png');
+  mkdirSync(path.dirname(fixture.databasePath), { recursive: true });
+  const database = new Database(fixture.databasePath);
+  try {
+    database.exec(`
+      CREATE TABLE IF NOT EXISTS scheduled_messages (
+        id TEXT PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        session_id TEXT NOT NULL,
+        content TEXT NOT NULL,
+        options TEXT NOT NULL DEFAULT '{}'
+      )
+    `);
+    database
+      .prepare('INSERT INTO scheduled_messages (id, user_id, session_id, content, options) VALUES (?, ?, ?, ?, ?)')
+      .run('scheduled-1', 1, 'session-1', 'hello', JSON.stringify({
+        attachments: [{ path: imagePath }],
+      }));
+  } finally {
+    database.close();
+  }
+  writeFileWithDirectories(
+    fixture.settingsPath,
+    `${JSON.stringify({ avatarPath: imagePath }, null, 2)}\n`,
+  );
+  return { imagePath };
+}
+
+function readScheduledOptions(databasePath: string): string {
+  const database = new Database(databasePath, { readonly: true });
+  try {
+    const row = database
+      .prepare('SELECT options FROM scheduled_messages WHERE id = ?')
+      .get('scheduled-1') as { options: string };
+    return row.options;
+  } finally {
+    database.close();
+  }
+}
+
+test('dry-run scans the legacy tree and persisted documents without writing anything', async (t) => {
+  const fixture = createFixture(t);
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'one.png'), 'one');
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'nested', 'two.pdf'), 'two');
+  const { imagePath } = seedPersistedPaths(fixture);
+  const before = snapshotTree(fixture.homeDir);
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  const exitCode = await service.execute(['--dry-run', '--json']);
+
+  assert.equal(exitCode, 0);
+  assert.deepEqual(snapshotTree(fixture.homeDir), before, 'a dry run must not create or modify a file');
+  const report = readJsonReport(capture.logMessages);
+  assert.equal(report.copied, 2);
+  assert.equal(report.skipped, 0);
+  assert.equal(report.rewritten, 2);
+  assert.deepEqual(report.conflicts, []);
+  assert.deepEqual(report.backupPaths, []);
+  assert.deepEqual(report.errors, []);
+  assert.equal(existsSync(path.join(fixture.newRoot, 'one.png')), false);
+  assert.match(readFileSync(fixture.settingsPath, 'utf8'), new RegExp(`"avatarPath": ${JSON.stringify(imagePath)}`));
+});
+
+test('--help and the bare command both print usage', async (t) => {
+  const fixture = createFixture(t);
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  assert.equal(await service.execute(['--help']), 0);
+  assert.match(capture.logMessages.join('\n'), /migrate-assets --dry-run/);
+  assert.match(capture.logMessages.join('\n'), /migrate-assets --rewrite/);
+
+  capture.logMessages.length = 0;
+  assert.equal(await service.execute([]), 1);
+  assert.match(capture.logMessages.join('\n'), /Usage:/);
+});
+
+test('--rewrite copies into the new root, keeps the legacy files, and is idempotent', async (t) => {
+  const fixture = createFixture(t);
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'one.png'), 'one');
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'two.pdf'), 'two');
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  assert.equal(await service.execute(['--rewrite', '--json']), 0);
+  const firstReport = readJsonReport(capture.logMessages);
+  assert.equal(firstReport.copied, 2);
+  assert.equal(firstReport.skipped, 0);
+  assert.equal(readFileSync(path.join(fixture.newRoot, 'one.png'), 'utf8'), 'one');
+  assert.equal(readFileSync(path.join(fixture.newRoot, 'two.pdf'), 'utf8'), 'two');
+  assert.equal(readFileSync(path.join(fixture.legacyRoot, 'one.png'), 'utf8'), 'one');
+  assert.equal(readFileSync(path.join(fixture.legacyRoot, 'two.pdf'), 'utf8'), 'two');
+
+  capture.logMessages.length = 0;
+  assert.equal(await service.execute(['--rewrite', '--json']), 0);
+  const secondReport = readJsonReport(capture.logMessages);
+  assert.equal(secondReport.copied, 0);
+  assert.equal(secondReport.skipped, 2, 'every file is skipped on the second run');
+  assert.deepEqual(secondReport.conflicts, []);
+});
+
+test('a conflicting target is never overwritten and is reported', async (t) => {
+  const fixture = createFixture(t);
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'photo.png'), 'legacy bytes');
+  writeFileWithDirectories(path.join(fixture.newRoot, 'photo.png'), 'newer bytes');
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  const exitCode = await service.execute(['--rewrite', '--json']);
+
+  assert.equal(exitCode, 0);
+  const report = readJsonReport(capture.logMessages);
+  assert.equal(report.copied, 0);
+  assert.deepEqual(report.conflicts, ['photo.png']);
+  assert.equal(readFileSync(path.join(fixture.newRoot, 'photo.png'), 'utf8'), 'newer bytes');
+  assert.equal(readFileSync(path.join(fixture.legacyRoot, 'photo.png'), 'utf8'), 'legacy bytes');
+});
+
+test('--rewrite rewrites app DB and JSON paths after taking a backup', async (t) => {
+  const fixture = createFixture(t);
+  const { imagePath } = seedPersistedPaths(fixture);
+  const beforeSettings = readFileSync(fixture.settingsPath, 'utf8');
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  const exitCode = await service.execute(['--rewrite', '--json']);
+
+  assert.equal(exitCode, 0);
+  const report = readJsonReport(capture.logMessages);
+  assert.equal(report.rewritten, 2);
+  assert.equal(report.backupPaths.length, 2, 'the database and the JSON state are both backed up');
+  for (const backupPath of report.backupPaths) {
+    assert.equal(existsSync(backupPath), true, `missing backup ${backupPath}`);
+  }
+
+  const expectedNewPath = path.join(fixture.newRoot, 'photo.png');
+  assert.equal(readFileSync(fixture.settingsPath, 'utf8'), beforeSettings.replace(imagePath, expectedNewPath));
+  assert.match(readScheduledOptions(fixture.databasePath), new RegExp(expectedNewPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+
+  const settingsBackup = report.backupPaths.find((backupPath) => backupPath.includes('server.settings.json'));
+  assert.ok(settingsBackup);
+  assert.equal(readFileSync(settingsBackup, 'utf8'), beforeSettings, 'the backup keeps the pre-rewrite bytes');
+
+  capture.logMessages.length = 0;
+  assert.equal(await service.execute(['--rewrite', '--json']), 0);
+  assert.equal(readJsonReport(capture.logMessages).rewritten, 0, 'a second run has nothing left to rewrite');
+});
+
+test('an injected write failure keeps the original files and creates no half-rewritten state', async (t) => {
+  const fixture = createFixture(t);
+  const { imagePath } = seedPersistedPaths(fixture);
+  const beforeSettings = readFileSync(fixture.settingsPath, 'utf8');
+  const beforeOptions = readScheduledOptions(fixture.databasePath);
+  const backingStore = createStore(fixture);
+  const failingStore: AssetPathStore = {
+    readDocuments: () => backingStore.readDocuments(),
+    backup: () => backingStore.backup(),
+    restore: (backupPaths) => backingStore.restore(backupPaths),
+    writeDocuments: (updates) => {
+      // Write the JSON half first so the failure happens mid-batch: a command
+      // that only reported the error would leave the settings file rewritten
+      // while the database row still held the legacy path.
+      backingStore.writeDocuments(
+        updates.filter((update) => update.document.handle.kind === 'json-file'),
+      );
+      throw new Error('injected write failure');
+    },
+  };
+  const { service, capture } = createService(fixture, failingStore);
+
+  const exitCode = await service.execute(['--rewrite', '--json']);
+
+  assert.equal(exitCode, 1);
+  const report = readJsonReport(capture.logMessages);
+  assert.equal(report.rewritten, 0);
+  assert.match(report.errors.join('\n'), /injected write failure/);
+  assert.ok(report.backupPaths.length > 0, 'backups are taken before the failing write');
+  assert.equal(readFileSync(fixture.settingsPath, 'utf8'), beforeSettings);
+  assert.equal(readScheduledOptions(fixture.databasePath), beforeOptions);
+  assert.match(capture.errorMessages.join('\n'), /injected write failure/);
+  assert.match(beforeSettings, new RegExp(imagePath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+});
+
+test('provider transcript references are listed as unrewritable and the command warns', async (t) => {
+  const fixture = createFixture(t);
+  writeFileWithDirectories(path.join(fixture.legacyRoot, 'one.png'), 'one');
+  const transcriptPath = path.join(fixture.homeDir, '.claude', 'projects', 'project-a', 'session.jsonl');
+  const legacyReference = path.join(fixture.legacyRoot, 'one.png');
+  writeFileWithDirectories(
+    transcriptPath,
+    [
+      JSON.stringify({ type: 'user', text: 'unrelated' }),
+      JSON.stringify({ type: 'user', text: `look at ${legacyReference}` }),
+    ].join('\n'),
+  );
+  const beforeTranscript = readFileSync(transcriptPath, 'utf8');
+  const { service, capture } = createService(fixture, createStore(fixture));
+
+  const exitCode = await service.execute(['--rewrite', '--json']);
+
+  assert.equal(exitCode, 3, 'unrewritable references must not look like success');
+  const report = readJsonReport(capture.logMessages);
+  assert.deepEqual(report.unrewritable, [`${transcriptPath}:2`]);
+  assert.match(capture.errorMessages.join('\n'), /unrewritable|not rewritten/);
+  assert.equal(readFileSync(transcriptPath, 'utf8'), beforeTranscript, 'transcripts are never rewritten');
+  assert.equal(existsSync(path.join(fixture.newRoot, 'one.png')), true, 'the copy half still runs');
+});

package/server/modules/cli/tests/browser-use-mcp-entry.test.ts

@@ -22,6 +22,7 @@
  */
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
+import http from 'node:http';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -193,6 +194,147 @@ async function readBootstrapEnvironment(): Promise<{ databasePath: string | null
   }
 }
 
+// ── brand-env wiring legs (gap-cloudpit-brand-env-reader-wiring) ───────────
+
+/** One HTTP request the MCP entry forwarded to the Browser API. */
+type CapturedApiRequest = {
+  path: string;
+  authorization: string | undefined;
+};
+
+/**
+ * Start a fake Browser API that records what the entry forwards.
+ *
+ * `browser_list_sessions` needs no arguments and reaches the API immediately,
+ * so an authorize/path reading here is a direct observation of the
+ * `apiUrl`/`apiToken` the entry resolved on start-up.
+ */
+async function startBrowserApiCapture(): Promise<{
+  baseUrl: string;
+  requests: CapturedApiRequest[];
+  close: () => Promise<void>;
+}> {
+  const requests: CapturedApiRequest[] = [];
+  const server = http.createServer((request, response) => {
+    let body = '';
+    request.setEncoding('utf8');
+    request.on('data', (chunk: string) => {
+      body += chunk;
+    });
+    request.on('end', () => {
+      requests.push({ path: request.url || '', authorization: request.headers.authorization });
+      response.writeHead(200, { 'Content-Type': 'application/json' });
+      response.end(JSON.stringify({ success: true, data: [] }));
+    });
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => resolve());
+  });
+
+  const address = server.address();
+  if (!address || typeof address === 'string') {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    throw new Error('the fake Browser API did not bind to a TCP port');
+  }
+
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}`,
+    requests,
+    close: () => new Promise<void>((resolve) => server.close(() => resolve())),
+  };
+}
+
+/** Every browser-use brand variable this criterion controls. */
+const BROWSER_USE_BRAND_ENV_KEYS = [
+  'CLOUDPIT_BROWSER_USE_API_URL',
+  'CLOUDCLI_BROWSER_USE_API_URL',
+  'CLOUDPIT_BROWSER_USE_MCP_TOKEN',
+  'CLOUDCLI_BROWSER_USE_MCP_TOKEN',
+  'CLOUDPIT_BROWSER_USE_API_TIMEOUT_MS',
+  'CLOUDCLI_BROWSER_USE_API_TIMEOUT_MS',
+];
+/** A child environment with every browser-use brand variable cleared, then `overrides`. */
+function browserUseEnvironment(
+  overrides: Record<string, string>,
+  homeDirectory: string,
+): NodeJS.ProcessEnv {
+  const environment = environmentWithoutDatabasePath(homeDirectory);
+  for (const key of BROWSER_USE_BRAND_ENV_KEYS) {
+    delete environment[key];
+  }
+  return { ...environment, ...overrides };
+}
+
+/** Call `browser_list_sessions` through the entry and return the child's output. */
+function requestBrowserListSessions(
+  environment: NodeJS.ProcessEnv,
+  timeoutMs = 60_000,
+): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawnWithTsx(ENTRY_PATH, environment);
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+
+    const finish = (error: Error | null) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.kill('SIGKILL');
+      if (error) reject(error);
+      else resolve({ stdout, stderr });
+    };
+
+    const timer = setTimeout(() => {
+      finish(new Error(`the MCP entry did not answer tools/call within ${timeoutMs}ms\nstdout:\n${stdout}\nstderr:\n${stderr}`));
+    }, timeoutMs);
+
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk;
+      for (const line of stdout.split('\n')) {
+        if (!line.trim()) continue;
+        let parsed: unknown;
+        try {
+          parsed = JSON.parse(line);
+        } catch {
+          continue; // Not a JSON-RPC frame; keep reading.
+        }
+        const frame = parsed as { id?: unknown };
+        if (frame.id === 2) finish(null);
+      }
+    });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    child.on('error', (error) => finish(error instanceof Error ? error : new Error(String(error))));
+    child.on('exit', (code) => {
+      finish(new Error(`the MCP entry exited (code ${String(code)}) before answering tools/call\nstdout:\n${stdout}\nstderr:\n${stderr}`));
+    });
+
+    child.stdin.write(`${JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: {},
+    })}\n`);
+    child.stdin.write(`${JSON.stringify({
+      jsonrpc: '2.0',
+      id: 2,
+      method: 'tools/call',
+      params: { name: 'browser_list_sessions', arguments: {} },
+    })}\n`);
+  });
+}
+
+/** Count non-overlapping occurrences of `needle` in `haystack`. */
+function countOccurrences(haystack: string, needle: string): number {
+  return haystack.split(needle).length - 1;
+}
+
 test('the relocated MCP entry answers initialize as cloudpit-browser', async () => {
   const reply = await requestInitialize();
   console.log(`(d) initialize reply: ${reply.rawLine}`);
@@ -201,6 +343,8 @@ test('the relocated MCP entry answers initialize as cloudpit-browser', async ()
   assert.ok(serverInfo && typeof serverInfo === 'object', `the initialize result must carry serverInfo: ${reply.rawLine}`);
   assert.equal(serverInfo.name, EXPECTED_SERVER_NAME, `serverInfo.name must stay ${EXPECTED_SERVER_NAME}: ${reply.rawLine}`);
   assert.equal(reply.result.protocolVersion, '2024-11-05', 'the MCP protocol version must stay pinned');
+  // 3.0 retired the legacy registrations: the wire identity never names one.
+  assert.equal(reply.rawLine.includes('cloudcli-browser'), false, 'no legacy MCP name may reach the client');
 });
 
 test('the relocated MCP entry still installs the root environment bootstrap', async () => {
@@ -218,3 +362,61 @@ test('the relocated MCP entry still installs the root environment bootstrap', as
     'importing the entry must run server/load-env.ts, which installs the user-level default DATABASE_PATH',
   );
 });
+
+test('AC5: CLOUDPIT_* supplies the MCP entry API URL and token', async () => {
+  const capture = await startBrowserApiCapture();
+  const homeDirectory = await mkdtemp(path.join(os.tmpdir(), 'cloudpit-mcp-brand-env-'));
+  try {
+    const output = await requestBrowserListSessions(browserUseEnvironment({
+      CLOUDPIT_BROWSER_USE_API_URL: `${capture.baseUrl}/api/new`,
+      CLOUDPIT_BROWSER_USE_MCP_TOKEN: 'new-token',
+      CLOUDCLI_BROWSER_USE_API_URL: `${capture.baseUrl}/api/old`,
+      CLOUDCLI_BROWSER_USE_MCP_TOKEN: 'old-token',
+    }, homeDirectory));
+
+    assert.equal(
+      capture.requests.length,
+      1,
+      `the entry must reach the fake API exactly once\nstdout:\n${output.stdout}\nstderr:\n${output.stderr}`,
+    );
+    assert.equal(
+      capture.requests[0].path,
+      '/api/new/tools/browser_list_sessions',
+      'the CLOUDPIT_BROWSER_USE_API_URL spelling must win',
+    );
+    assert.equal(capture.requests[0].authorization, 'Bearer new-token');
+  } finally {
+    await capture.close();
+    await rm(homeDirectory, { recursive: true, force: true });
+  }
+});
+
+test('AC5 (v3.0): the legacy spelling is ignored, so the entry refuses without a token', async () => {
+  const capture = await startBrowserApiCapture();
+  const homeDirectory = await mkdtemp(path.join(os.tmpdir(), 'cloudpit-mcp-brand-env-'));
+  try {
+    const output = await requestBrowserListSessions(browserUseEnvironment({
+      CLOUDCLI_BROWSER_USE_API_URL: `${capture.baseUrl}/api/legacy`,
+      CLOUDCLI_BROWSER_USE_MCP_TOKEN: 'legacy-token',
+    }, homeDirectory));
+
+    assert.equal(
+      capture.requests.length,
+      0,
+      `the retired spelling must not reach the fake API\nstdout:\n${output.stdout}\nstderr:\n${output.stderr}`,
+    );
+    assert.match(
+      output.stdout,
+      /CLOUDPIT_BROWSER_USE_MCP_TOKEN is not configured\./,
+      `the entry must report the missing canonical token\nstdout:\n${output.stdout}`,
+    );
+    assert.equal(
+      countOccurrences(output.stderr, 'is deprecated'),
+      0,
+      'the retired spelling must not emit a deprecation warning',
+    );
+  } finally {
+    await capture.close();
+    await rm(homeDirectory, { recursive: true, force: true });
+  }
+});

package/server/modules/cli/tests/cli-environment-bootstrap.test.ts

@@ -103,6 +103,7 @@ export function createCliApplication() {
     },
     output: { log: () => undefined, error: () => undefined },
     sandboxService: { execute: async () => 0 },
+    assetMigrationService: { execute: async () => 0 },
     getLatestPackageVersion: async () => '1.0.0',
     updateGlobalPackage: () => undefined,
     startServer: async () => undefined,

package/server/modules/cli/tests/cli.service.test.ts

@@ -38,6 +38,9 @@ function createHarness(
         return 7;
       },
     },
+    assetMigrationService: {
+      execute: async () => 0,
+    },
     getLatestPackageVersion: async () => '1.2.3',
     updateGlobalPackage: () => undefined,
     startServer: async () => {
@@ -91,12 +94,14 @@ test('returns a failure code for an unknown command without exiting the process'
 
 test('help text falls back to the fork repository when package metadata is missing', async () => {
   // No homepage/bugsUrl: the help text must use its own fallbacks, not the upstream repository.
+  // The fork's distribution identity is yaleh/cloudpit (a7942b0f9) — pin the shipped fallback, not
+  // the pre-rename repository name.
   const harness = createHarness({ version: '1.2.3' });
 
   const exitCode = await harness.service.run(['help']);
 
   assert.equal(exitCode, 0);
   const helpText = harness.logMessages.join('\n');
-  assert.match(helpText, /yaleh\/claudecodeui/, 'the missing-metadata fallback must name the fork repository');
+  assert.match(helpText, /yaleh\/cloudpit/, 'the missing-metadata fallback must name the fork repository');
   assert.doesNotMatch(helpText, /siteboon/, 'the missing-metadata fallback must not name upstream siteboon');
 });

package/server/modules/cockpit/cockpit-brief-prompt.ts

@@ -104,7 +104,7 @@ const EXAMPLE = `{
 
 /** The fixed instructions; the same text is sent every round. */
 export const BRIEF_SYSTEM_PROMPT = [
-  '你是 CloudCLI 驾驶舱的简报生成器。为一张等待用户决定的卡片写一份 BriefSpec v0 JSON。',
+  '你是 Cloudpit 驾驶舱的简报生成器。为一张等待用户决定的卡片写一份 BriefSpec v0 JSON。',
   '',
   '只输出 JSON 对象本身：不要代码围栏，不要解释，不要前后缀文字。',
   '',

package/server/modules/cockpit/cockpit-card-actions.ts

@@ -18,7 +18,8 @@
  * An option's declared `params` are passed to the executor VERBATIM (the
  * criterion compares them with `deepEqual`). A free-text reply has no declared
  * params of its own for the text, so the text joins `ownReply.params` under
- * `reply` — that is the one field the channel adds.
+ * `reply`. A knowledge decision routed to `fleet.apply` is the one addition:
+ * its server-verified `confirmation` is injected before the executor runs.
  *
  * Errors are `AppError`s, so the thin route just forwards them to the server's
  * existing error middleware and a caller reads a status + a stable code.
@@ -120,6 +121,9 @@ export const NO_FEEDBACK_EXECUTOR_REASON =
 export const FEEDBACK_EXECUTOR_GONE_REASON =
   '该提供方已不再声明原来的反馈执行器，无法重发';
 
+/** The fleet executor that consumes a trusted knowledge decision's `confirmation`. */
+const KNOWLEDGE_DECISION_EXECUTOR_ID = 'fleet.apply';
+
 type ParsedConfirmRequest = {
   cardId: string;
   revision: number;
@@ -556,9 +560,22 @@ export function createCockpitCardActions(deps: {
     }
 
     accepted.add(key);
+    // A knowledge decision routed to `fleet.apply` carries the server-verified confirmation the
+    // fleet validates; every other executor keeps its declared params byte-for-byte.
+    const params = { ...action.params };
+    if (knowledge !== undefined && action.executor === KNOWLEDGE_DECISION_EXECUTOR_ID) {
+      const binding: Record<string, unknown> = { ...knowledge.feedback };
+      delete binding.confirmationRef;
+      params.confirmation = {
+        actorKind: 'human',
+        decisionRef: knowledge.ref,
+        at: now().toISOString(),
+        binding,
+      };
+    }
     let result: unknown;
     try {
-      result = await executor.execute(action.params);
+      result = await executor.execute(params);
     } catch (failure) {
       // The action did not happen, so the revision stays confirmable.
       accepted.delete(key);
@@ -596,7 +613,7 @@ export function createCockpitCardActions(deps: {
       ok: true,
       cardId: card.id,
       executor: action.executor,
-      params: action.params,
+      params,
       result,
     };
   };