agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/claude-capture.test.ts

@@ -1,242 +0,0 @@
-import { execFile } from 'node:child_process';
-import { createServer, type IncomingHttpHeaders } from 'node:http';
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { delimiter, dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, describe, expect, it } from 'vitest';
-
-const exec = promisify(execFile);
-const CLI = fileURLToPath(new URL('../dist/cli.js', import.meta.url));
-const MODEL = 'claude-sonnet-4-6';
-const closers: Array<() => Promise<unknown>> = [];
-afterEach(async () => {
-  while (closers.length) await closers.pop()!();
-});
-
-function message(model: string) {
-  return {
-    id: 'msg_fixture',
-    type: 'message',
-    role: 'assistant',
-    model,
-    content: [{ type: 'text', text: 'captured' }],
-    stop_reason: 'end_turn',
-    stop_sequence: null,
-    usage: { input_tokens: 10, output_tokens: 2 },
-  };
-}
-
-function stream(model: string) {
-  const events = [
-    {
-      type: 'message_start',
-      message: {
-        ...message(model),
-        content: [],
-        stop_reason: null,
-        usage: { input_tokens: 10, output_tokens: 0 },
-      },
-    },
-    { type: 'content_block_start', index: 0, content_block: { type: 'text', text: '' } },
-    { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: 'captured' } },
-    { type: 'content_block_stop', index: 0 },
-    {
-      type: 'message_delta',
-      delta: { stop_reason: 'end_turn', stop_sequence: null },
-      usage: { output_tokens: 2 },
-    },
-    { type: 'message_stop' },
-  ];
-  return events.map((e) => `event: ${e.type}\ndata: ${JSON.stringify(e)}\n\n`).join('');
-}
-
-async function setup(binary: string) {
-  const root = await mkdtemp(join(tmpdir(), 'agenticreplay-claude-capture-'));
-  closers.push(() => rm(root, { recursive: true, force: true }));
-  await exec('git', ['init', '-q'], { cwd: root });
-  const calls: { path: string; headers: IncomingHttpHeaders; body: Record<string, unknown> }[] = [];
-  const paths: string[] = [];
-  const upstream = createServer(async (req, res) => {
-    const chunks: Buffer[] = [];
-    for await (const chunk of req) chunks.push(Buffer.from(chunk));
-    const body = JSON.parse(Buffer.concat(chunks).toString() || '{}');
-    const path = new URL(req.url!, 'http://fixture').pathname;
-    paths.push(path);
-    if (path === '/v1/messages/count_tokens') {
-      res.writeHead(200, { 'content-type': 'application/json' }).end('{"input_tokens":10}');
-      return;
-    }
-    if (path !== '/v1/messages') {
-      res.writeHead(404).end();
-      return;
-    }
-    calls.push({ path, headers: req.headers, body });
-    res.writeHead(200, { 'content-type': body.stream ? 'text/event-stream' : 'application/json' });
-    res.end(body.stream ? stream(body.model) : JSON.stringify(message(body.model)));
-  });
-  await new Promise<void>((resolve) => upstream.listen(0, '127.0.0.1', resolve));
-  closers.push(() => new Promise<void>((resolve) => upstream.close(() => resolve())));
-  const upstreamUrl = `http://127.0.0.1:${(upstream.address() as { port: number }).port}`;
-  // Block unintended external requests from the isolated harness, including OAuth profile lookups.
-  const deny = createServer((_req, res) => res.writeHead(403).end());
-  deny.on('connect', (_req, socket) => {
-    socket.on('error', () => undefined);
-    socket.end('HTTP/1.1 403 Forbidden\r\n\r\n');
-  });
-  await new Promise<void>((resolve) => deny.listen(0, '127.0.0.1', resolve));
-  closers.push(() => new Promise<void>((resolve) => deny.close(() => resolve())));
-  const denyUrl = `http://127.0.0.1:${(deny.address() as { port: number }).port}`;
-  const env: Record<string, string> = {
-    PATH: [dirname(binary), dirname(process.execPath), '/usr/bin', '/bin'].join(delimiter),
-    HOME: root,
-    USERPROFILE: root,
-    CLAUDE_CONFIG_DIR: join(root, 'claude'),
-    XDG_CONFIG_HOME: join(root, 'config'),
-    XDG_DATA_HOME: join(root, 'data'),
-    XDG_CACHE_HOME: join(root, 'cache'),
-    XDG_STATE_HOME: join(root, 'state'),
-    HTTP_PROXY: denyUrl,
-    HTTPS_PROXY: denyUrl,
-    NO_PROXY: '127.0.0.1,localhost',
-    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
-    CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL: '1',
-    CLAUDE_CODE_DISABLE_TERMINAL_TITLE: '1',
-  };
-  return { root, calls, paths, upstreamUrl, env };
-}
-
-async function record(s: Awaited<ReturnType<typeof setup>>, adapter: string, args: string[]) {
-  const pending = exec(
-    process.execPath,
-    [
-      CLI,
-      'record',
-      adapter,
-      '--no-fs',
-      '--no-shell',
-      '--json',
-      '--upstream-anthropic',
-      s.upstreamUrl,
-      '--',
-      ...args,
-    ],
-    {
-      cwd: s.root,
-      env: s.env,
-      timeout: 45000,
-      maxBuffer: 2 * 1024 * 1024,
-    },
-  );
-  pending.child.stdin?.end();
-  const result = await pending.catch((error) => {
-    throw new Error(`${String(error)}\nObserved upstream paths: ${JSON.stringify(s.paths)}`);
-  });
-  const recorded = JSON.parse(result.stdout);
-  expect(recorded.exitCode, result.stderr).toBe(0);
-  expect(recorded.modelExchanges).toBeGreaterThan(0);
-  const raw = await readFile(join(recorded.runDir, 'events.jsonl'), 'utf8');
-  const events = raw
-    .trim()
-    .split('\n')
-    .map((line) => JSON.parse(line));
-  expect(events.filter((e) => e.type === 'model.request')).toHaveLength(recorded.modelExchanges);
-  expect(events.filter((e) => e.type === 'model.response')).toHaveLength(recorded.modelExchanges);
-  expect(
-    events.filter((e) => e.type === 'model.response').every((e) => e.attrs.status === 200),
-  ).toBe(true);
-  expect(
-    events.some(
-      (e) => e.type === 'model.response' && e.attrs.streamed && e.attrs.output_tokens === 2,
-    ),
-  ).toBe(true);
-  expect(raw).not.toMatch(/fixture-api-secret|fixture-oauth-secret|fixture-bearer-secret/);
-  return recorded;
-}
-
-// Build first; opt in with absolute installed binary paths. No real accounts or user config.
-describe.skipIf(!process.env.AGENTICREPLAY_TEST_CLAUDE)(
-  'installed Claude Code through agenticreplay record',
-  () => {
-    it.each(['api', 'bearer', 'oauth'] as const)(
-      'records %s authentication and SSE',
-      async (auth) => {
-        const s = await setup(process.env.AGENTICREPLAY_TEST_CLAUDE!);
-        const secret = `fixture-${auth}-secret`;
-        s.env[
-          auth === 'api'
-            ? 'ANTHROPIC_API_KEY'
-            : auth === 'bearer'
-              ? 'ANTHROPIC_AUTH_TOKEN'
-              : 'CLAUDE_CODE_OAUTH_TOKEN'
-        ] = secret;
-        await record(s, 'claude', [
-          '-p',
-          'Reply with captured.',
-          '--model',
-          MODEL,
-          '--tools',
-          '',
-          '--safe-mode',
-          '--setting-sources',
-          '',
-          '--strict-mcp-config',
-          '--mcp-config',
-          '{"mcpServers":{}}',
-          '--system-prompt',
-          'Reply briefly.',
-        ]);
-        expect(s.calls.length).toBeGreaterThan(0);
-        for (const call of s.calls) {
-          expect(call.body.model).toBe(MODEL);
-          expect(call.headers[auth === 'api' ? 'x-api-key' : 'authorization']).toBe(
-            auth === 'api' ? secret : `Bearer ${secret}`,
-          );
-          if (auth === 'oauth')
-            expect(call.headers['anthropic-beta']).toContain('oauth-2025-04-20');
-        }
-      },
-      60000,
-    );
-  },
-);
-
-describe.skipIf(!process.env.AGENTICREPLAY_TEST_OPENCODE)(
-  'OpenCode Anthropic through agenticreplay record',
-  () => {
-    it('records Claude model requests with an API key', async () => {
-      const s = await setup(process.env.AGENTICREPLAY_TEST_OPENCODE!);
-      s.env.ANTHROPIC_API_KEY = 'fixture-api-secret';
-      Object.assign(s.env, {
-        OPENCODE_DISABLE_PROJECT_CONFIG: '1',
-        OPENCODE_DISABLE_MODELS_FETCH: '1',
-        OPENCODE_DISABLE_AUTOUPDATE: '1',
-        OPENCODE_DISABLE_FFF: '1',
-        OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER: '1',
-        OPENCODE_CONFIG_CONTENT: JSON.stringify({
-          enabled_providers: ['anthropic'],
-          model: `anthropic/${MODEL}`,
-          small_model: `anthropic/${MODEL}`,
-          provider: { anthropic: { models: { [MODEL]: { name: MODEL } } } },
-        }),
-      });
-      const configDir = join(s.env.XDG_CONFIG_HOME!, 'opencode');
-      await mkdir(join(configDir, 'node_modules'), { recursive: true });
-      await writeFile(
-        join(configDir, 'package-lock.json'),
-        JSON.stringify({
-          lockfileVersion: 3,
-          packages: { '': { dependencies: { '@opencode-ai/plugin': '1.18.29' } } },
-        }),
-      );
-      await record(s, 'opencode', [
-        'run',
-        '-m',
-        `anthropic/${MODEL}`,
-        'Reply with captured. Do not use tools.',
-      ]);
-      for (const call of s.calls) expect(call.headers['x-api-key']).toBe('fixture-api-secret');
-    }, 60000);
-  },
-);

package/packages/cli/test/compare.test.ts

@@ -1,329 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { TraceReader, deriveCheckpoints, listRuns } from '@agenticreplay/core';
-import { parseArgs } from '../src/args.js';
-import { Output } from '../src/out.js';
-import { recordCommand } from '../src/commands/record.js';
-import { compareCommand, formatCost } from '../src/commands/compare.js';
-import { startFakeModel } from './fixtures/fake-model.mjs';
-
-const run = promisify(execFile);
-const here = dirname(fileURLToPath(import.meta.url));
-const FAKE_AGENT = join(here, 'fixtures', 'fake-agent.mjs');
-
-describe('compare without --models', () => {
-  /**
-   * This test used to swap `XDG_CONFIG_HOME` itself, because `compareCommand` falls back to
-   * `readConfig()` and so read the *real* `~/.config/agenticreplay`: on a machine where anyone had run
-   * `agenticreplay setup`, that config has models in it and this never reached the branch it names.
-   *
-   * vitest.setup.ts now does that for the whole suite, and for a larger reason than this test —
-   * the same fallback was sending live requests to the developer's gateway from the fork tests.
-   */
-  it('tells you both ways to supply models when none are available', async () => {
-    const lines: string[] = [];
-    const out = new Output({ write: (l) => void lines.push(l), isTTY: false });
-    const home = await mkdtemp(join(tmpdir(), 'agenticreplay-cmp-cfg-'));
-    try {
-      await expect(compareCommand(parseArgs(['compare', 'last']), out, home)).rejects.toThrow(
-        /agenticreplay setup/,
-      );
-    } finally {
-      await rm(home, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
-    }
-  });
-});
-
-describe('compare', () => {
-  let workspace: string;
-  let model: Awaited<ReturnType<typeof startFakeModel>>;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-cmp-'));
-    model = await startFakeModel();
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-    await run('git', ['init', '-q'], { cwd: workspace });
-    await run('git', ['config', 'user.email', 't@e.com'], { cwd: workspace });
-    await run('git', ['config', 'user.name', 'T'], { cwd: workspace });
-    await writeFile(join(workspace, 'auth.ts'), 'export const fixed = false;\n');
-    process.env.FAKE_AGENT_TURNS = '3';
-    process.env.FAKE_AGENT_CWD = workspace;
-  });
-
-  afterEach(async () => {
-    await model.close();
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  async function record() {
-    return recordCommand(
-      parseArgs([
-        'record',
-        'generic-openai',
-        '--upstream-anthropic',
-        model.url,
-        '--',
-        'node',
-        FAKE_AGENT,
-      ]),
-      out,
-      workspace,
-    );
-  }
-
-  it('needs models, and says how to give them', async () => {
-    // Same reason as the block above: without an empty config this reads the developer's own
-    // `agenticreplay setup` models, never reaches the branch, and fails on "no runs recorded" instead.
-    const previous = process.env.XDG_CONFIG_HOME;
-    process.env.XDG_CONFIG_HOME = join(workspace, 'empty-config');
-    try {
-      await expect(compareCommand(parseArgs(['compare', 'last']), out, workspace)).rejects.toThrow(
-        /--models/,
-      );
-    } finally {
-      if (previous === undefined) delete process.env.XDG_CONFIG_HOME;
-      else process.env.XDG_CONFIG_HOME = previous;
-    }
-  });
-
-  it('forks every model from the SAME parent run, not from the previous fork', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const from = deriveCheckpoints(events)[0]!.seq;
-
-    const rows = await compareCommand(
-      parseArgs([
-        'compare',
-        'last',
-        '--from',
-        String(from),
-        '--models',
-        'claude-opus-5,glm-5.3-flash,qwen3-coder',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    expect(rows).toHaveLength(3);
-    // The bug this pins: "last" is re-resolved per fork, so after the first branch it points at
-    // the fork just created — which has no checkpoints — and every later model fails.
-    for (const row of rows) {
-      expect(row.error, `${row.model} should not have errored: ${row.error}`).toBeUndefined();
-      expect(row.verdict).toBe('pass');
-      expect(row.forkRunId).toBeTruthy();
-    }
-    expect(new Set(rows.map((r) => r.forkRunId)).size).toBe(3);
-  });
-
-  /**
-   * A RUN CAN ARRIVE WITHOUT THE STORE ITS OWN EVENTS POINT AT.
-   *
-   * `agenticreplay pull` produces one unless the run was pushed with `--fs`: the archive then carries
-   * manifest.json, events.jsonl, redactions.json and blobs/ — not `fs/` — so a pulled run's
-   * `fs.snapshot` events name trees whose objects were never sent. The restore then died inside git with "failed to unpack tree
-   * object <40 hex>", which names neither the cause nor anything to do about it, on the exact path
-   * the gateway console prints under "fork it locally": `agenticreplay pull <run>`, then `agenticreplay compare`.
-   *
-   * Deleting the store is what the wire leaves behind, so that is what this sets up.
-   */
-  it('says why a run without its snapshots cannot be forked, and forks it anyway with --no-fs', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const from = deriveCheckpoints(events)[0]!.seq;
-    await rm(join(first.runDir, 'fs'), { recursive: true, force: true });
-
-    const argv = (extra: string[]) =>
-      parseArgs([
-        'compare',
-        'last',
-        '--from',
-        String(from),
-        '--models',
-        'claude-opus-5',
-        '--upstream-anthropic',
-        model.url,
-        ...extra,
-      ]);
-
-    const refused = await compareCommand(argv([]), out, workspace);
-    expect(refused[0]!.verdict).toBe('fail');
-    expect(refused[0]!.error, 'the error should name the missing snapshot').toMatch(
-      /no workspace snapshot/,
-    );
-    // The detail belongs where a reader will find it. `compare` renders each leg's error in one
-    // cell of a table, so the cause and the way out go in the warning rather than the message.
-    const warned = lines.find((l) => l.includes('fork.no_snapshot'));
-    expect(warned, 'fork.no_snapshot was not reported').toBeDefined();
-    expect(warned).toMatch(/--no-fs/);
-
-    // And the way out has to work, or the diagnosis is just a nicer dead end. This also covers the
-    // forwarding: `compare` builds a fresh argv per fork, and a flag accepted here and dropped
-    // there is the silent no-op that list already warns about twice.
-    const forked = await compareCommand(argv(['--no-fs']), out, workspace);
-    expect(forked[0]!.error, `--no-fs should have forked: ${forked[0]!.error}`).toBeUndefined();
-    expect(forked[0]!.verdict).toBe('pass');
-  });
-
-  it('creates one child run per model, all descended from the original', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const from = deriveCheckpoints(events)[0]!.seq;
-
-    await compareCommand(
-      parseArgs([
-        'compare',
-        'last',
-        '--from',
-        String(from),
-        '--models',
-        'claude-opus-5,glm-5.3-flash',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    const runs = await listRuns(workspace);
-    expect(runs).toHaveLength(3);
-
-    for (const runRef of runs.filter((r) => r.runId !== first.runId)) {
-      const forkEvents = await (await TraceReader.open(runRef.dir)).events();
-      const fork = forkEvents.find((e) => e.type === 'fork');
-      expect(fork?.attrs?.parent_run, 'every branch must fork the original run').toBe(first.runId);
-      expect(fork?.attrs?.fork_point).toBe(from);
-    }
-  });
-
-  it('prints a verdict table with a dash for an unpriced model, never $0.00', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const from = deriveCheckpoints(events)[0]!.seq;
-
-    await compareCommand(
-      parseArgs([
-        'compare',
-        'last',
-        '--from',
-        String(from),
-        '--models',
-        'claude-opus-5,not-a-real-model',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    const text = lines.join('');
-    expect(text).toMatch(/MODEL\s+VERDICT\s+TOKENS\s+COST/);
-    // A confidently wrong cost is worse than an absent one when it lands in a comparison table.
-    expect(text).toContain('—');
-  });
-});
-
-describe('cost formatting', () => {
-  it('never renders a real cost as $0.0000', () => {
-    expect(formatCost(null)).toBe('—');
-    expect(formatCost(0)).toBe('$0');
-    expect(formatCost(5.8123)).toBe('$5.8123');
-    // The two that matter: a cheap model is the reason the column exists.
-    expect(formatCost(0.00004)).not.toMatch(/^\$0\.0000$/);
-    expect(formatCost(0.000_002)).not.toMatch(/^\$0\.0000$/);
-  });
-});
-
-describe('verify command', () => {
-  let workspace: string;
-  let model: Awaited<ReturnType<typeof startFakeModel>>;
-  let out: Output;
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-verify-'));
-    model = await startFakeModel();
-    out = new Output({ write: () => {}, isTTY: false });
-    await run('git', ['init', '-q'], { cwd: workspace });
-    await run('git', ['config', 'user.email', 't@e.com'], { cwd: workspace });
-    await run('git', ['config', 'user.name', 'T'], { cwd: workspace });
-    await writeFile(join(workspace, 'auth.ts'), 'export const fixed = false;\n');
-    process.env.FAKE_AGENT_TURNS = '3';
-    // Deliberately NOT pinning FAKE_AGENT_CWD: the agent should write to its own working
-    // directory, which is the fork worktree during a fork — that is what a real agent does, and
-    // it is the only way this test can tell the worktree and the workspace apart.
-    delete process.env.FAKE_AGENT_CWD;
-  });
-
-  afterEach(async () => {
-    await model.close();
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  async function compareWith(verify: string[]) {
-    const first = await recordCommand(
-      parseArgs([
-        'record',
-        'generic-openai',
-        '--upstream-anthropic',
-        model.url,
-        '--',
-        'node',
-        FAKE_AGENT,
-      ]),
-      out,
-      workspace,
-    );
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const from = deriveCheckpoints(events)[0]!.seq;
-    return compareCommand(
-      parseArgs([
-        'compare',
-        'last',
-        '--from',
-        String(from),
-        '--models',
-        'claude-opus-5',
-        '--upstream-anthropic',
-        model.url,
-        ...verify,
-      ]),
-      out,
-      workspace,
-    );
-  }
-
-  it('fails the verdict when the verify command fails, even though the agent exited 0', async () => {
-    const rows = await compareWith(['--verify', 'exit 1']);
-    // Without --verify, "pass" only means the agent did not crash — which is not the question
-    // anyone is asking of a comparison table.
-    expect(rows[0]!.verdict).toBe('fail');
-    expect(rows[0]!.verifyExitCode).toBe(1);
-  });
-
-  it('passes the verdict when the verify command passes', async () => {
-    const rows = await compareWith(['--verify', 'exit 0']);
-    expect(rows[0]!.verdict).toBe('pass');
-    expect(rows[0]!.verifyExitCode).toBe(0);
-  });
-
-  it('runs the verify command inside the fork worktree, not the original workspace', async () => {
-    // auth.ts only contains "fixed = true" in the fork, where the agent wrote it.
-    const rows = await compareWith(['--verify', 'grep -q "fixed = true" auth.ts']);
-    expect(rows[0]!.verdict).toBe('pass');
-  });
-
-  it('falls back to the agent exit code when no verify command is given', async () => {
-    const rows = await compareWith([]);
-    expect(rows[0]!.verifyExitCode).toBeUndefined();
-    expect(rows[0]!.verdict).toBe('pass');
-  });
-});

package/packages/cli/test/config-permission-failure.test.ts

@@ -1,41 +0,0 @@
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('@agenticreplay/core', async (importOriginal) => {
-  const real = await importOriginal<typeof import('@agenticreplay/core')>();
-  return {
-    ...real,
-    restrictToOwner: async (path: string, mode: 0o600 | 0o700) => {
-      if (mode === 0o700) throw new Error('untrusted config directory owner');
-      await real.restrictToOwner(path, mode);
-    },
-  };
-});
-
-const { writeConfig } = await import('../src/config.js');
-
-describe.runIf(process.platform === 'win32')('config directory refusal', () => {
-  let root: string;
-  afterEach(async () => {
-    if (root) await rm(root, { recursive: true, force: true });
-  });
-
-  it('keeps the old config and writes no credential when its parent cannot be secured', async () => {
-    root = await mkdtemp(join(tmpdir(), 'agenticreplay-config-refusal-'));
-    const dir = join(root, 'agenticreplay');
-    await mkdir(dir);
-    await writeFile(join(dir, 'config.json'), 'previous config');
-    await expect(
-      writeConfig(
-        { gateway: { url: 'https://example.test', api_key: 'new-secret' } },
-        {
-          XDG_CONFIG_HOME: root,
-        },
-      ),
-    ).rejects.toThrow(/untrusted config directory owner/);
-    expect(await readFile(join(dir, 'config.json'), 'utf8')).toBe('previous config');
-    expect(await readdir(dir)).toEqual(['config.json']);
-  });
-});