agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/e2e.test.ts

@@ -1,1230 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, readFile, readdir, rm, symlink, unlink, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  TraceReader,
-  deriveCheckpoints,
-  listRuns,
-  resolveRunSelector,
-  runGraph,
-  chainTo,
-} from '@agenticreplay/core';
-import { isBlobRef, validateEvent, validateManifest } from '@agenticreplay/schema';
-import { parseArgs } from '../src/args.js';
-import { Output } from '../src/out.js';
-import { recordCommand } from '../src/commands/record.js';
-import { replayCommand } from '../src/commands/replay.js';
-import { startFakeModel } from './fixtures/fake-model.mjs';
-import { existsSync, mkdirSync, symlinkSync, unlinkSync } from 'node:fs';
-
-const run = promisify(execFile);
-const here = dirname(fileURLToPath(import.meta.url));
-const FAKE_AGENT = join(here, 'fixtures', 'fake-agent.mjs');
-
-/**
- * Run `body` with the temp directory pointed somewhere only this test can reach, and hand back
- * what was left in it.
- *
- * A replay's safety scratch goes to `os.tmpdir()`, so asserting on what it leaves there means
- * asserting on a directory the whole machine shares — the other suites replay too, and a test
- * that diffed the real `$TMPDIR` failed under `vitest run` while passing on its own. Moving the
- * directory for the duration makes "nothing was left behind" a statement about this replay.
- */
-async function withIsolatedTmp<T>(
-  body: () => Promise<T>,
-): Promise<{ result: T; leftBehind: string[] }> {
-  const isolated = await mkdtemp(join(tmpdir(), 'agenticreplay-tmproot-'));
-  const saved = { TMPDIR: process.env.TMPDIR, TMP: process.env.TMP, TEMP: process.env.TEMP };
-  process.env.TMPDIR = isolated;
-  process.env.TMP = isolated;
-  process.env.TEMP = isolated;
-  try {
-    const result = await body();
-    return { result, leftBehind: await readdir(isolated) };
-  } finally {
-    for (const [key, value] of Object.entries(saved)) {
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-  }
-}
-
-/**
- * The acceptance test for the whole project.
- *
- *   agenticreplay record <agent>
- *   agenticreplay replay last
- *   agenticreplay replay last --from N --model <other>
- *
- * If these three work against a real child process, a real proxy and a real trace on disk, the
- * mechanism is proven. Everything else is refinement.
- */
-describe('end to end: record → replay → fork', () => {
-  let workspace: string;
-  let model: Awaited<ReturnType<typeof startFakeModel>>;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-e2e-'));
-    model = await startFakeModel();
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-    // A git repo so the shadow index has something to work with.
-    await run('git', ['init', '-q'], { cwd: workspace });
-    await run('git', ['config', 'user.email', 'test@example.com'], { cwd: workspace });
-    await run('git', ['config', 'user.name', 'Test'], { cwd: workspace });
-    await writeFile(join(workspace, 'auth.ts'), 'export const fixed = false;\n');
-  });
-
-  afterEach(async () => {
-    await model.close();
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  async function record(turns = 3) {
-    const args = parseArgs([
-      'record',
-      'generic-openai',
-      '--upstream-anthropic',
-      model.url,
-      '--',
-      'node',
-      FAKE_AGENT,
-    ]);
-    process.env.FAKE_AGENT_TURNS = String(turns);
-    delete process.env.FAKE_AGENT_CWD;
-    return recordCommand(args, out, workspace);
-  }
-
-  it('records a run that validates against the normative schema', async () => {
-    const result = await record();
-
-    expect(result.events).toBeGreaterThan(4);
-
-    const reader = await TraceReader.open(result.runDir);
-    expect(validateManifest(reader.manifest()).valid).toBe(true);
-    for (const event of await reader.events()) {
-      const r = validateEvent(event);
-      expect(r.valid, `seq ${event.seq}: ${r.errors.join(', ')}`).toBe(true);
-    }
-  });
-
-  it('captures the tool loop the agent actually ran', async () => {
-    const result = await record();
-    const reader = await TraceReader.open(result.runDir);
-    const events = await reader.events();
-    const types = events.map((e) => e.type);
-
-    expect(types).toContain('model.request');
-    expect(types).toContain('model.response');
-    // The whole thesis: a proxy that only sees model traffic still recovers the tool loop.
-    expect(types).toContain('tool.call');
-    expect(types).toContain('tool.result');
-
-    const call = events.find((e) => e.type === 'tool.call');
-    expect(call?.attrs?.name).toBe('edit_file');
-  });
-
-  it('captures the filesystem change the agent made', async () => {
-    const result = await record();
-    const events = await (await TraceReader.open(result.runDir)).events();
-    const changes = events.filter((e) => e.type === 'fs.change');
-    expect(changes.some((c) => String(c.attrs?.path).endsWith('auth.ts'))).toBe(true);
-    expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toContain('fixed = true');
-  });
-
-  it('verifies its own integrity digest', async () => {
-    const result = await record();
-    expect((await (await TraceReader.open(result.runDir)).verifyIntegrity()).ok).toBe(true);
-  });
-
-  it('replays exactly, with the model server never contacted again', async () => {
-    await record();
-    const callsAfterRecording = model.calls.length;
-    expect(callsAfterRecording).toBeGreaterThan(0);
-
-    const result = await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-
-    expect(result.mode).toBe('exact');
-    expect(result.canonicalExact).toBeGreaterThan(0);
-    expect(result.divergences).toBe(0);
-    expect(result.liveCalls).toBe(0);
-    expect(model.calls.length, 'exact replay must not reach the network at all').toBe(
-      callsAfterRecording,
-    );
-  });
-
-  it('replays exactly when the recorded bodies are large enough to spill to blobs', async () => {
-    // The size is the test. Under the inline limit a body is stored as itself; over it, the writer
-    // spills `JSON.stringify(payload)` and the body becomes a quoted, escaped JSON string literal.
-    // Replay read those bytes back without undoing the encoding, so it canonicalized an escaped
-    // copy — `model: ''`, `messages: []` — and matched nothing against any real harness, which all
-    // send a system prompt big enough to spill on turn one. Every other test here stayed under the
-    // limit, so all of them passed while replay was completely broken in practice.
-    process.env.FAKE_AGENT_PAD = '400';
-    try {
-      const recorded = await record();
-      const events = await (await TraceReader.open(recorded.runDir)).events();
-      const request = events.find((e) => e.type === 'model.request');
-      expect(isBlobRef(request?.payload), 'fixture must cross the spill boundary').toBe(true);
-
-      const result = await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-
-      expect(result.canonicalExact).toBeGreaterThan(0);
-      expect(result.divergences).toBe(0);
-      expect(result.liveCalls).toBe(0);
-    } finally {
-      delete process.env.FAKE_AGENT_PAD;
-    }
-  });
-
-  it('halts with a reason, not a hang, when the agent asks something else', async () => {
-    await record();
-
-    // Same recording, different question: nothing can match, and the operator has to be told why.
-    process.env.FAKE_AGENT_PROMPT = 'do something completely different';
-    try {
-      const result = await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-
-      expect(result.canonicalExact).toBe(0);
-      expect(result.exitCode, 'a halted replay must not look like a clean run').not.toBe(0);
-      const halt = lines.find((l) => l.includes('replay.unmatched'));
-      expect(halt, `no halt reason in output:\n${lines.join('\n')}`).toBeDefined();
-      expect(halt).toContain('does not match the recording');
-    } finally {
-      delete process.env.FAKE_AGENT_PROMPT;
-    }
-  });
-
-  it('replays a run that changed the files it depends on', async () => {
-    // The one that made exact replay useless on a real agent. The recording reads auth.ts into the
-    // conversation and then edits it, so by the time you replay, the working tree no longer holds
-    // what the recorded request contains. Replaying in place re-reads the mutated file, the
-    // trailing message differs, and the run halts at rung 4 — correctly, but uselessly: nothing
-    // about the recording changed, only the directory it ran in.
-    //
-    // Replay therefore restores the filesystem the run started from, the same way a fork does.
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      const mutated = await readFile(join(workspace, 'auth.ts'), 'utf8');
-      expect(
-        mutated,
-        'the recording must have changed the file for this test to mean anything',
-      ).not.toBe('export const fixed = false;\n');
-
-      const result = await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-
-      expect(result.canonicalExact).toBeGreaterThan(0);
-      expect(result.exitCode).toBe(0);
-      expect(lines.join('\n')).not.toContain('replay.unmatched');
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  it('leaves the working tree exactly as it found it', async () => {
-    // Replay restores the recorded state over the working tree, because a harness bakes absolute
-    // paths into its tool calls and a copy somewhere else gets a permission refusal where the
-    // recording has file contents. That is only acceptable because it is reversible: the current
-    // state is snapshotted first and put back afterwards, so a replay is observationally a no-op
-    // on your checkout.
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      const before = await readFile(join(workspace, 'auth.ts'), 'utf8');
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-      expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toBe(before);
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  it('replays in the directory the run was recorded in, not a copy of it', async () => {
-    // The property the whole restore exists for. Harnesses record absolute paths, so the replay
-    // has to happen at the same path or the agent is reading somewhere it was never given.
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-      const replaying = lines.find((l) => l.includes('info replaying')) ?? '';
-      expect(replaying).toContain(`cwd=${workspace}`);
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  /**
-   * A refusal must not cost you your working tree.
-   *
-   * `upstreamPlan` rejects an upstream that is not an origin, and it used to be resolved *after*
-   * `replayWorkspace` had already replaced the checkout with the recording — so the throw escaped
-   * the `finally` that puts the tree back, which only begins at the child's launch. The operator's
-   * own files were left in an `agenticreplay-safety-*` scratch nothing pointed at, on a command that had
-   * just printed "your files are restored when the replay ends".
-   *
-   * Asserted on the file rather than on the error, because the error was never the problem.
-   */
-  it('leaves the working tree alone when it refuses the upstream', async () => {
-    await record();
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-    await expect(
-      replayCommand(
-        parseArgs(['replay', 'last', '--upstream-openai', 'myuser:PASSWORD@gw.example/v1']),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/is not an origin agenticreplay can use/);
-
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a refused replay must not have touched the checkout',
-    ).toBe('MY UNCOMMITTED WORK\n');
-    // And it never claimed to have: the restore line belongs to a replay that got that far.
-    expect(lines.join('\n')).not.toContain('replay.restored');
-  });
-
-  /**
-   * Nor may a refusal leave a run behind.
-   *
-   * The same misordering as above, in its quiet form. `upstreamPlan` throws for an upstream that is
-   * not an origin, and every command resolved it *after* creating the run directory — `record`,
-   * `attach`, and the fork path, which also restores a temp worktree first. So a typo in
-   * `--upstream-*` left an empty run for `agenticreplay list` to show, reading `FROM <parent>@<n>` on a fork
-   * as though it had run, plus a restored tree abandoned in `$TMPDIR`. Nothing was lost, which is
-   * why it went unnoticed; it is the same rule, and the rule is that an invocation which cannot
-   * work decides so before it touches anything.
-   */
-  it('leaves no run behind when it refuses the upstream', async () => {
-    const BAD = 'myuser:PASSWORD@gw.example/v1';
-
-    const before = (await listRuns(workspace)).length;
-    await expect(
-      recordCommand(
-        parseArgs(['record', 'generic-openai', '--upstream-openai', BAD, '--', 'node', FAKE_AGENT]),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/is not an origin agenticreplay can use/);
-    expect((await listRuns(workspace)).length, 'a refused record must not have created a run').toBe(
-      before,
-    );
-
-    // The fork path gets there by a different route: a checkpoint restored into a temp worktree and
-    // a second run directory, both made before the upstream was ever looked at.
-    await record();
-    const afterGood = (await listRuns(workspace)).length;
-    await expect(
-      replayCommand(
-        parseArgs([
-          'replay',
-          'last',
-          '--from',
-          '1',
-          '--model',
-          'gpt-5.2',
-          '--upstream-openai',
-          BAD,
-        ]),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/is not an origin agenticreplay can use/);
-    expect((await listRuns(workspace)).length, 'a refused fork must not have created a run').toBe(
-      afterGood,
-    );
-  });
-
-  /**
-   * The same rule, for the other refusal in the same window.
-   *
-   * `--tls-hosts` is refused by `resolveTlsHosts`/`HostPolicy.from`, and that happened inside
-   * `setupTlsCapture` — reached after `replayWorkspace` had already written the recording over the
-   * checkout, and after the replay's own run directory existed. The throw escaped the `finally`
-   * that puts the tree back for the same reason the upstream one did: that `finally` only begins
-   * at the child's launch. So the operator was left holding the recording's files, with their own
-   * work in an `agenticreplay-safety-*` scratch whose path nothing prints.
-   *
-   * `planTlsCapture` is the refusing half on its own and mints nothing; `attach` already calls it
-   * before its run directory for exactly this reason.
-   */
-  it('leaves the working tree alone when it refuses the tls host list', async () => {
-    await record();
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-    const before = (await listRuns(workspace)).length;
-
-    await expect(
-      replayCommand(
-        parseArgs(['replay', 'last', '--tls-intercept', '--tls-hosts', '*']),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/would intercept every host/);
-
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a refused replay must not have touched the checkout',
-    ).toBe('MY UNCOMMITTED WORK\n');
-    // And it never claimed to have: the restore line belongs to a replay that got that far.
-    expect(lines.join('\n')).not.toContain('replay.restored');
-    expect((await listRuns(workspace)).length, 'nor created a run for it').toBe(before);
-  });
-
-  /**
-   * The refusal that hoisting alone would still have missed.
-   *
-   * `AGENTICREPLAY_TLS_UPSTREAM_CA` is read from disk, so it cannot be decided from the arguments the way
-   * a host list can — `setupTlsCapture` opens it, past the restore. Two things now stand between
-   * that and the operator's checkout: `planTlsCapture` reads the roots too, so the refusal
-   * happens before `replayWorkspace`; and the release is armed for the whole restored span, so a
-   * throw that gets past the first still puts the tree back.
-   *
-   * Worth its own test because it is the one that proves the rule generalises. `createProxy`,
-   * `RunCa.create` and `adapter.prepare` all sit in the same window and are not on any list.
-   */
-  it('leaves the working tree alone when the upstream CA cannot be read', async () => {
-    await record();
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-    process.env.AGENTICREPLAY_TLS_UPSTREAM_CA = join(workspace, 'no-such-root.pem');
-    try {
-      await expect(
-        replayCommand(
-          parseArgs(['replay', 'last', '--tls-intercept', '--tls-hosts', 'api.openai.com']),
-          out,
-          workspace,
-        ),
-      ).rejects.toThrow(/ENOENT|no such file/);
-    } finally {
-      delete process.env.AGENTICREPLAY_TLS_UPSTREAM_CA;
-    }
-
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a refused replay must not have touched the checkout',
-    ).toBe('MY UNCOMMITTED WORK\n');
-    expect(lines.join('\n')).not.toContain('replay.restored');
-  });
-
-  /**
-   * And the same on the two paths where only scratch is at stake.
-   *
-   * A fork restores its checkpoint into a temp worktree and opens its own run before it reaches
-   * `setupTlsCapture`, and `record` opens its run first too — so a refused host list left an empty
-   * run for `agenticreplay list` to show, plus a worktree in `$TMPDIR` that `agenticreplay gc` will not reclaim
-   * because no manifest points at it. Cheaper than the checkout, the same rule.
-   */
-  it('leaves no run behind when it refuses the tls host list', async () => {
-    const before = (await listRuns(workspace)).length;
-    await expect(
-      recordCommand(
-        parseArgs([
-          'record',
-          'generic-openai',
-          '--tls-intercept',
-          '--tls-hosts',
-          '*',
-          '--',
-          'node',
-          FAKE_AGENT,
-        ]),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/would intercept every host/);
-    expect((await listRuns(workspace)).length, 'a refused record must not have created a run').toBe(
-      before,
-    );
-
-    await record();
-    const afterGood = (await listRuns(workspace)).length;
-    await expect(
-      replayCommand(
-        parseArgs([
-          'replay',
-          'last',
-          '--from',
-          '1',
-          '--model',
-          'gpt-5.2',
-          '--tls-intercept',
-          '--tls-hosts',
-          '*',
-        ]),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/would intercept every host/);
-    expect((await listRuns(workspace)).length, 'a refused fork must not have created a run').toBe(
-      afterGood,
-    );
-  });
-
-  /**
-   * The restore is inside the thing that undoes it, so the caller cannot guard it.
-   *
-   * `replayWorkspace` snapshots the checkout, then overwrites it, then returns the `release` that
-   * puts it back — so a `materialize` that fails rejects before its caller has anything to call.
-   * The guard in `replayExact` is armed on the next line and never ran; the scratch holding the
-   * only copy of the operator's tree was abandoned in `$TMPDIR` with nothing printing its path.
-   *
-   * The store is emptied of its objects rather than deleted, so `FsCapture.start` still opens it
-   * and the failure lands where it matters: on `read-tree`, inside the restore. `agenticreplay gc` on a
-   * half-copied trace gets there the same way.
-   */
-  it('puts the working tree back when the restore itself fails', async () => {
-    const recorded = await record();
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-    // A shadow store that opens and holds nothing: every loose-object directory removed.
-    const objects = join(recorded.runDir, 'fs', 'objects');
-    for (const entry of await readdir(objects)) {
-      if (/^[0-9a-f]{2}$/.test(entry)) await rm(join(objects, entry), { recursive: true });
-    }
-
-    const { leftBehind } = await withIsolatedTmp(async () => {
-      await expect(replayCommand(parseArgs(['replay', 'last']), out, workspace)).rejects.toThrow();
-    });
-
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a replay whose restore failed must not have kept the operator out of their own tree',
-    ).toBe('MY UNCOMMITTED WORK\n');
-    // The release ran, which is the whole assertion: it is the only thing that removes the
-    // scratch, and it removes it only once the tree is back.
-    expect(leftBehind, 'nor left the only copy of it in a temp directory nothing names').toEqual(
-      [],
-    );
-  });
-
-  /**
-   * A replay that dies after minting a certificate authority must take the key with it.
-   *
-   * `tls-capture.ts` puts it in writing — "the caller owns the CA's lifetime and must dispose it
-   * on every exit path" — and `replayCommand` had no equivalent of the `minted` wrapper that
-   * `recordCommand` and `attachCommand` use. Between `RunCa.create` and the child's launch sit
-   * `createProxy`, `mcpForReplay` and `adapter.prepare`, and a throw from any of them left
-   * `tls/ca.key` on disk.
-   *
-   * The throw here is a trace naming an adapter this build does not have, which is what replaying
-   * a newer agenticreplay's recording looks like. It also pins the other half: the proxy is listening by
-   * then, and a proxy that is not closed keeps Node's event loop alive — so a regression shows up
-   * as this test timing out rather than as a hang nobody notices until a user reports it.
-   */
-  it('takes the run CA with it when the replay dies after minting one', async () => {
-    const recorded = await record();
-    const manifestPath = join(recorded.runDir, 'manifest.json');
-    const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as {
-      adapter: { id: string };
-    };
-    manifest.adapter.id = 'agent-from-the-future';
-    await writeFile(manifestPath, JSON.stringify(manifest));
-
-    await expect(
-      replayCommand(
-        parseArgs(['replay', 'last', '--tls-intercept', '--tls-hosts', 'api.openai.com']),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/unknown adapter/);
-
-    const withKey: string[] = [];
-    const runsRoot = join(workspace, '.agenticreplay', 'runs');
-    for (const run of await readdir(runsRoot)) {
-      const entries = await readdir(join(runsRoot, run)).catch(() => [] as string[]);
-      if (entries.includes('tls')) withKey.push(run);
-    }
-    expect(withKey, 'a replay that refused after minting must not leave the key').toEqual([]);
-  });
-
-  /**
-   * The one line a reader checks to know whether a run can spend money.
-   *
-   * `egress` was a literal, so `--loose` — which answers an unmatched request from the provider —
-   * still announced `blocked`. Asserted on both spellings rather than only the flag's, because the
-   * bug was that one value was printed for two behaviours; a test that only pins `--loose` would
-   * pass again the moment someone hardcoded the other way round.
-   */
-  it('says egress is blocked only when it is, and says so differently under --loose', async () => {
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-      const strict = lines.find((l) => l.includes('info replaying')) ?? '';
-      expect(strict).toContain('egress=blocked');
-
-      lines.length = 0;
-      await replayCommand(parseArgs(['replay', 'last', '--loose']), out, workspace);
-      const loose = lines.find((l) => l.includes('info replaying')) ?? '';
-      expect(loose, `no replaying line in:\n${lines.join('\n')}`).not.toContain('egress=blocked');
-      expect(loose).toContain('egress=live-on-unmatched');
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  it('names the snapshot it can restore from if a replay dies halfway', async () => {
-    // The safety net has to be visible before it is needed. If the process is killed between the
-    // restore and the put-back, this id is the only way back to the tree you had.
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-      const line = lines.find((l) => l.includes('replay.restored')) ?? '';
-      expect(line, `no restore line in:\n${lines.join('\n')}`).toMatch(/[0-9a-f]{40}/);
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  /**
-   * "Your files are restored when the replay ends" has two halves, and the put-back kept neither
-   * where the recorded tree and the working tree disagree about what exists. It is undone from an
-   * ordinary snapshot, which honours `.gitignore`, so a file the recording tracked and the
-   * workspace ignores now was overwritten with no copy to restore it from. And a snapshot restore
-   * writes files without removing any, so a file the recording had and the operator has deleted
-   * since came back, and stayed.
-   */
-  it('puts back exactly the tree it found: nothing lost, nothing added', async () => {
-    await writeFile(join(workspace, 'settings.json'), '{"endpoint":"recorded"}\n');
-    mkdirSync(join(workspace, 'legacy'));
-    await writeFile(join(workspace, 'legacy', 'old-config.env'), 'OLD CONFIG\n');
-    const recorded = await record(2);
-
-    // Since the recording: the legacy directory is gone, and settings.json became a local file.
-    await rm(join(workspace, 'legacy'), { recursive: true, force: true });
-    await writeFile(join(workspace, '.gitignore'), 'settings.json\n');
-    await writeFile(join(workspace, 'settings.json'), '{"endpoint":"MY LOCAL SETTINGS"}\n');
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-    const { leftBehind } = await withIsolatedTmp(async () => {
-      await expect(
-        replayCommand(parseArgs(['replay', recorded.runId]), out, workspace),
-      ).rejects.toThrow(/would overwrite settings\.json/);
-    });
-    expect(
-      await readFile(join(workspace, 'settings.json'), 'utf8'),
-      'an ignored file the copy does not hold must not be overwritten',
-    ).toBe('{"endpoint":"MY LOCAL SETTINGS"}\n');
-    expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toBe('MY UNCOMMITTED WORK\n');
-    expect(leftBehind, 'a refused replay must not leave its copy behind').toEqual([]);
-
-    // Moved aside, the replay runs, and hands back the tree it found — without the files the
-    // recording had and this tree does not, and without the directory it made for them.
-    await rm(join(workspace, 'settings.json'));
-    await replayCommand(parseArgs(['replay', recorded.runId]), out, workspace);
-    expect(existsSync(join(workspace, 'legacy')), 'a deleted directory came back').toBe(false);
-    expect(existsSync(join(workspace, 'settings.json')), 'a removed file came back').toBe(false);
-    expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toBe('MY UNCOMMITTED WORK\n');
-    expect(await readFile(join(workspace, '.gitignore'), 'utf8')).toBe('settings.json\n');
-  });
-
-  /**
-   * The same promise, for what the replayed agent writes rather than what the restore does. An exact
-   * replay makes the recorded agent do what it did, so a file it created during the recording is
-   * created again — and the put-back, whose copy never had it, left it in the operator's tree.
-   */
-  it('takes away what the replayed agent created, as well as what the restore wrote', async () => {
-    await rm(join(workspace, 'auth.ts'));
-    const recorded = await record(2);
-    expect(existsSync(join(workspace, 'auth.ts')), 'fixture: the agent creates auth.ts').toBe(true);
-    await rm(join(workspace, 'auth.ts'));
-    await writeFile(join(workspace, 'notes.txt'), 'MY NOTES\n');
-
-    const replayed = await replayCommand(parseArgs(['replay', recorded.runId]), out, workspace);
-    expect(replayed.canonicalExact, 'the agent must actually have run').toBe(2);
-    expect(existsSync(join(workspace, 'auth.ts')), 'the replayed agent left its file').toBe(false);
-    expect(await readFile(join(workspace, 'notes.txt'), 'utf8')).toBe('MY NOTES\n');
-  });
-
-  /**
-   * A file standing where the recording had a directory is in the way of every path under it, and
-   * the restore deletes it to make the directory. `lstat` answers ENOTDIR for those paths, which
-   * read as "nothing there" — so an ignored file at such a path was destroyed without a copy.
-   */
-  it('counts a file where the recording had a directory as something it would overwrite', async () => {
-    mkdirSync(join(workspace, 'cfg'));
-    await writeFile(join(workspace, 'cfg', 'app.json'), '{"recorded":true}\n');
-    const recorded = await record(2);
-    await rm(join(workspace, 'cfg'), { recursive: true, force: true });
-    await writeFile(join(workspace, '.gitignore'), 'cfg\n');
-    await writeFile(join(workspace, 'cfg'), 'MY LOCAL CFG FILE\n');
-
-    await expect(
-      replayCommand(parseArgs(['replay', recorded.runId]), out, workspace),
-    ).rejects.toThrow(/would overwrite cfg:/);
-    expect(await readFile(join(workspace, 'cfg'), 'utf8')).toBe('MY LOCAL CFG FILE\n');
-  });
-
-  /**
-   * A junction is a directory as far as git is concerned: the copy holds what is inside it as
-   * ordinary files, and the restore writes through it. Judged by `lstat`, which calls it a link,
-   * a file deleted from under one refused the whole replay — "would overwrite data" — when the
-   * restore would only have written that file back and the put-back taken it away again. On POSIX
-   * git records a symlink as itself, so there this holds trivially; on Windows it is the case.
-   */
-  it('treats a directory link git walks into as the directory it is', async () => {
-    const outside = await mkdtemp(join(tmpdir(), 'agenticreplay-outside-'));
-    const link = join(workspace, 'data');
-    symlinkSync(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
-    try {
-      await writeFile(join(outside, 'a.csv'), 'A\n');
-      await writeFile(join(outside, 'b.csv'), 'B\n');
-      const recorded = await record(2);
-      await rm(join(outside, 'b.csv'));
-      await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-      const replayed = await replayCommand(parseArgs(['replay', recorded.runId]), out, workspace);
-      expect(replayed.canonicalExact).toBe(2);
-      expect(await readdir(outside), 'the deleted file must stay deleted').toEqual(['a.csv']);
-      expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toBe('MY UNCOMMITTED WORK\n');
-    } finally {
-      // The link first and on its own, so nothing recursive ever walks through it.
-      unlinkSync(link);
-      await rm(outside, { recursive: true, force: true });
-    }
-  });
-
-  /**
-   * The other half of the case above: a file where the recording had a directory, and one the copy
-   * DOES hold. The restore deletes it to make the directory; the put-back writes it back, and
-   * `checkout-index -f` clears the directory it made to do so. So this replays, rather than being
-   * refused — and the operator's uncommitted edit survives it. Pinned because it was disputed: the
-   * claim was that the put-back skips a file over a non-empty directory, which git 2.43 (Linux) and
-   * 2.55 (Windows) both do not.
-   */
-  it('puts back a held file where the recording had a directory', async () => {
-    mkdirSync(join(workspace, 'cfg'));
-    await writeFile(join(workspace, 'cfg', 'app.json'), '{"recorded":true}\n');
-    const recorded = await record(2);
-    await rm(join(workspace, 'cfg'), { recursive: true, force: true });
-    await writeFile(join(workspace, 'cfg'), 'MY UNCOMMITTED EDIT\n');
-
-    const replayed = await replayCommand(parseArgs(['replay', recorded.runId]), out, workspace);
-    expect(replayed.canonicalExact).toBe(2);
-    expect(await readFile(join(workspace, 'cfg'), 'utf8')).toBe('MY UNCOMMITTED EDIT\n');
-  });
-
-  it('does not leave a copy of the working tree in the temp directory', async () => {
-    // The safety snapshot is a shadow git store holding the whole workspace, and it was never
-    // removed — one per `agenticreplay replay`, growing with the size of your checkout, in a directory
-    // `agenticreplay gc` deliberately will not sweep because it only reclaims fork worktrees. Replay owns
-    // it, so replay has to clean it up.
-    //
-    // Watched in a temp directory of this test's own, not in the machine's. Diffing a listing of
-    // the whole OS temp dir before and after cannot tell a directory *this* replay created from
-    // one another test's replay created in the same window, so under the parallel suite it failed
-    // with nothing wrong. `replay.ts` calls `tmpdir()` at the moment it mkdtemps, so redirecting
-    // it here is enough, and leaves the product's own output alone.
-    const isolatedTmp = await mkdtemp(join(tmpdir(), 'agenticreplay-e2e-tmp-'));
-    const outerTmp = { TEMP: process.env.TEMP, TMP: process.env.TMP, TMPDIR: process.env.TMPDIR };
-    process.env.TEMP = isolatedTmp;
-    process.env.TMP = isolatedTmp;
-    process.env.TMPDIR = isolatedTmp;
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-      const leaked = (await readdir(isolatedTmp)).filter((e) =>
-        e.startsWith('agenticreplay-safety-'),
-      );
-      expect(leaked, 'the pre-replay snapshot store must not outlive the replay').toEqual([]);
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-      for (const [key, value] of Object.entries(outerTmp)) {
-        if (value === undefined) delete process.env[key];
-        else process.env[key] = value;
-      }
-      await rm(isolatedTmp, { recursive: true, force: true });
-    }
-  });
-
-  /**
-   * `--worktree` promises never to touch your files, and two branches ahead of the one that reads
-   * it broke the promise: `--in-place` given beside it won without a word, and a run recorded with
-   * --no-fs fell through to the in-place warning and ran the agent over the working tree anyway —
-   * the recorded edit landed on uncommitted work.
-   */
-  it('never replays in your directory once asked for a scratch copy', async () => {
-    const withFs = await record(2);
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-    await expect(
-      replayCommand(
-        parseArgs(['replay', withFs.runId, '--worktree', '--in-place']),
-        out,
-        workspace,
-      ),
-    ).rejects.toThrow(/cannot both apply/);
-    expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toBe('MY UNCOMMITTED WORK\n');
-
-    const noFs = await recordCommand(
-      parseArgs([
-        'record',
-        'generic-openai',
-        '--no-fs',
-        '--upstream-anthropic',
-        model.url,
-        '--',
-        'node',
-        FAKE_AGENT,
-      ]),
-      out,
-      workspace,
-    );
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-    const { leftBehind } = await withIsolatedTmp(async () => {
-      await expect(
-        replayCommand(parseArgs(['replay', noFs.runId, '--worktree']), out, workspace),
-      ).rejects.toThrow(/no workspace snapshot to copy/);
-    });
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a replay asked for a scratch copy must not have written into the checkout',
-    ).toBe('MY UNCOMMITTED WORK\n');
-    expect(leftBehind).toEqual([]);
-    const warned = lines.find((l) => l.includes('replay.no_snapshot')) ?? '';
-    expect(warned, `no diagnosis in:\n${lines.join('\n')}`).toContain('--in-place');
-    expect(lines.join('\n')).not.toContain('replay.in-place');
-
-    // Unchanged without the flag: a run with no snapshot still replays where it is, and says so.
-    const inPlace = await replayCommand(parseArgs(['replay', noFs.runId]), out, workspace);
-    expect(inPlace.canonicalExact).toBe(2);
-    expect(lines.join('\n')).toContain('replay.in-place');
-  });
-
-  it('does not touch the working tree when asked to replay in a scratch copy', async () => {
-    process.env.FAKE_AGENT_READ = 'auth.ts';
-    try {
-      await record();
-      await replayCommand(parseArgs(['replay', 'last', '--worktree']), out, workspace);
-      const replaying = lines.find((l) => l.includes('info replaying')) ?? '';
-      expect(replaying).not.toContain(`cwd=${workspace}`);
-      expect(lines.join('\n')).not.toContain('replay.restored');
-    } finally {
-      delete process.env.FAKE_AGENT_READ;
-    }
-  });
-
-  /**
-   * A RUN CAN BE WITHOUT THE STORE ITS OWN EVENTS POINT AT: pulled from a gateway it was pushed to
-   * without `--fs`, or put through `agenticreplay scrub --drop-fs`. Either way its `fs.snapshot` events name
-   * trees that are nowhere on this machine, and a restore of one died inside git — "failed to
-   * unpack tree object <40 hex>" — on `agenticreplay replay` and `--worktree` alike, while only the fork
-   * path said what had happened. Each refusal also left an empty directory in `$TMPDIR` that
-   * nothing named and `agenticreplay gc` never reclaims.
-   */
-  it('says why it cannot restore a run whose snapshots are gone, and leaves nothing behind', async () => {
-    const recorded = await record(2);
-    const from = deriveCheckpoints(await (await TraceReader.open(recorded.runDir)).events())[0]!
-      .seq;
-    await rm(join(recorded.runDir, 'fs'), { recursive: true, force: true });
-    await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-
-    const { leftBehind } = await withIsolatedTmp(async () => {
-      for (const extra of [[], ['--worktree']]) {
-        await expect(
-          replayCommand(parseArgs(['replay', recorded.runId, ...extra]), out, workspace),
-        ).rejects.toThrow(/no workspace snapshot to restore/);
-      }
-      await expect(
-        replayCommand(
-          parseArgs([
-            'replay',
-            recorded.runId,
-            '--from',
-            String(from),
-            '--model',
-            'claude-sonnet-5',
-            '--upstream-anthropic',
-            model.url,
-          ]),
-          out,
-          workspace,
-        ),
-      ).rejects.toThrow(/no workspace snapshot for the checkpoint/);
-    });
-
-    // Both causes named, because nothing on disk says which it was — and the first one has a way
-    // back that the old wording ("never the filesystem snapshots") said did not exist.
-    const warned = lines.filter((l) => /(replay|fork)\.no_snapshot/.test(l));
-    expect(warned, `expected three diagnoses in:\n${lines.join('\n')}`).toHaveLength(3);
-    for (const line of warned) {
-      expect(line).toContain('pushed with --fs');
-      expect(line).toContain('--drop-fs');
-    }
-    expect(warned.slice(0, 2).every((l) => l.includes('--in-place'))).toBe(true);
-    expect(warned[2]).toContain('--no-fs');
-
-    expect(leftBehind, 'a refusal must not leave a worktree in the temp directory').toEqual([]);
-    expect(
-      await readFile(join(workspace, 'auth.ts'), 'utf8'),
-      'a refused replay must not have touched the checkout',
-    ).toBe('MY UNCOMMITTED WORK\n');
-
-    // And the way out it names has to work, or the diagnosis is just a nicer dead end.
-    const inPlace = await replayCommand(
-      parseArgs(['replay', recorded.runId, '--in-place']),
-      out,
-      workspace,
-    );
-    expect(inPlace.unmatched).toBe(0);
-    expect(inPlace.canonicalExact).toBe(2);
-  });
-
-  it('says where the recording ran and where the replay ran when it halts', async () => {
-    // A halt reason like "distance 205343" is true and useless. The most common cause by far is
-    // that the recorded conversation contains absolute paths from the directory the run was made
-    // in and the replay is somewhere else, so the harness refuses the read and the tool result
-    // comes back as a permission error instead of the file. Both directories on the line is what
-    // turns the number into something an operator can act on — including confirming they match.
-    await record();
-    // Set *after* recording: the replay has to ask something the recording cannot answer.
-    process.env.FAKE_AGENT_PROMPT = 'ask something else entirely';
-    try {
-      await replayCommand(parseArgs(['replay', 'last']), out, workspace);
-
-      const halt = lines.find((l) => l.includes('replay.unmatched')) ?? '';
-      expect(halt).toContain(`recorded_in=${workspace}`);
-      expect(halt).toContain(`replayed_in=${workspace}`);
-      expect(halt).toContain('--loose');
-    } finally {
-      delete process.env.FAKE_AGENT_PROMPT;
-    }
-  });
-
-  it('points at the recording directory when the replay is somewhere else', async () => {
-    await record();
-    const elsewhere = await mkdtemp(join(tmpdir(), 'agenticreplay-elsewhere-'));
-    process.env.FAKE_AGENT_PROMPT = 'ask something else entirely';
-    try {
-      // Copy the trace, not the files: this is someone replaying a colleague's run.
-      await run('cp', ['-r', join(workspace, '.agenticreplay'), elsewhere]);
-      await replayCommand(parseArgs(['replay', 'last']), out, elsewhere);
-
-      const warned = lines.find((l) => l.includes('replay.elsewhere')) ?? '';
-      expect(warned, `no elsewhere warning in:\n${lines.join('\n')}`).toContain(workspace);
-      expect(warned).toContain('--worktree');
-    } finally {
-      delete process.env.FAKE_AGENT_PROMPT;
-      await rm(elsewhere, { recursive: true, force: true });
-    }
-  });
-
-  /**
-   * The directory a run was recorded in is that directory however the path to it is spelled.
-   *
-   * Windows hands a process its working directory as typed — `C:\…` from PowerShell, `c:\…` from
-   * cmd — and a junction or symlink names the same folder differently again. Compared as strings,
-   * the replay called it "elsewhere", skipped the safety copy, and the recorded edit replaced
-   * uncommitted work in the very directory the run was made in.
-   */
-  it('restores and puts back where it was recorded, however that path is spelled', async () => {
-    await record(2);
-    const aliasRoot = await mkdtemp(join(tmpdir(), 'agenticreplay-alias-'));
-    const alias = join(aliasRoot, 'same');
-    await symlink(workspace, alias, process.platform === 'win32' ? 'junction' : 'dir');
-    const spellings = [alias];
-    if (process.platform === 'win32') {
-      spellings.push(workspace.replace(/^[A-Z]:/, (drive) => drive.toLowerCase()));
-    }
-    try {
-      for (const cwd of spellings) {
-        await writeFile(join(workspace, 'auth.ts'), 'MY UNCOMMITTED WORK\n');
-        await replayCommand(parseArgs(['replay', 'last']), out, cwd);
-        expect(
-          await readFile(join(workspace, 'auth.ts'), 'utf8'),
-          `replayed from ${cwd}: the checkout must come back as it was`,
-        ).toBe('MY UNCOMMITTED WORK\n');
-      }
-      expect(lines.join('\n')).not.toContain('replay.elsewhere');
-      expect(lines.filter((l) => l.includes('replay.restored'))).toHaveLength(spellings.length);
-    } finally {
-      // The link first and on its own, so nothing recursive ever walks into the workspace.
-      await unlink(alias);
-      await rm(aliasRoot, { recursive: true, force: true });
-    }
-  });
-
-  it('records the commit the run started from', async () => {
-    // `manifest.git` is in the schema, the Python reader parses it, and nothing ever wrote it — so
-    // every trace was missing the single most useful piece of provenance for "why did my agent
-    // delete my file": which commit it was looking at.
-    // The shared fixture inits a repo but never commits, so HEAD is unborn there. Commit here
-    // rather than in `beforeEach`: other tests assert on a dirty tree and should keep doing so.
-    await run('git', ['add', '-A'], { cwd: workspace });
-    await run('git', ['commit', '-qm', 'initial'], { cwd: workspace });
-
-    const result = await record();
-    const manifest = (await TraceReader.open(result.runDir)).manifest();
-    const head = (await run('git', ['rev-parse', 'HEAD'], { cwd: workspace })).stdout.trim();
-
-    expect(manifest.git?.head).toBe(head);
-    expect(manifest.git?.branch).toBeDefined();
-    // The agent edits a file, so by the end the tree is dirty — but `git` describes the state the
-    // run *started* from, which is what makes it a reproduction instruction.
-    expect(manifest.git?.dirty).toBe(false);
-  });
-
-  it('closes the proxy and seals the trace when the agent will not start', async () => {
-    // Two bugs, one cause. `recordCommand` had no `try/finally`, so a throw skipped both
-    // `proxy.close()` and `writer.close()`.
-    //
-    // The proxy is the visible one: a listening server keeps Node's event loop alive, so
-    // `agenticreplay record generic-openai -- /nonexistent` printed its error and then **hung** — verified
-    // against the built CLI, killed at 12s. Mistyping an agent name is the first thing a new user
-    // does.
-    //
-    // The trace is the quieter one: everything the agent did is on disk, but with no `ended_at`,
-    // no `counts` and no `integrity`, so `verifyIntegrity` reports the run as tampered rather than
-    // as unfinished. The same shape loses a complete recording to one failed write.
-    const args = parseArgs([
-      'record',
-      'generic-openai',
-      '--upstream-anthropic',
-      model.url,
-      '--',
-      join(workspace, 'no-such-binary'),
-    ]);
-
-    await expect(recordCommand(args, out, workspace)).rejects.toThrow();
-
-    const runs = await listRuns(workspace);
-    expect(runs, 'the run directory should still exist').toHaveLength(1);
-    const manifest = (await TraceReader.open(runs[0]!.dir)).manifest();
-    expect(manifest.ended_at, 'a failed run must still be sealed').toBeDefined();
-    expect(manifest.integrity?.events_sha256).toBeDefined();
-  });
-
-  it('derives checkpoints you can fork from', async () => {
-    const result = await record();
-    const events = await (await TraceReader.open(result.runDir)).events();
-    const checkpoints = deriveCheckpoints(events);
-    expect(checkpoints.length).toBeGreaterThan(0);
-    expect(checkpoints[0]!.fsTree).toBeTruthy();
-  });
-
-  it('forks from a checkpoint and continues live on a different model', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const checkpoint = deriveCheckpoints(events)[0]!;
-    const callsBefore = model.calls.length;
-
-    const result = await replayCommand(
-      parseArgs([
-        'replay',
-        'last',
-        '--from',
-        String(checkpoint.seq),
-        '--model',
-        'glm-5.3-flash',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    expect(result.mode).toBe('fork');
-    expect(result.forkRunId).toBeTruthy();
-    expect(result.forkRunId).not.toBe(first.runId);
-    // Live calls happened past the fork point — that is what makes it a fork rather than a replay.
-    expect(result.liveCalls).toBeGreaterThan(0);
-    expect(model.calls.length).toBeGreaterThan(callsBefore);
-
-    // And the substituted model actually reached the upstream.
-    const forkedCalls = model.calls.slice(callsBefore);
-    expect(forkedCalls.some((c) => c.body?.model === 'glm-5.3-flash')).toBe(true);
-  });
-
-  it('records the fork with provenance pointing back at its parent', async () => {
-    const first = await record();
-    const events = await (await TraceReader.open(first.runDir)).events();
-    const checkpoint = deriveCheckpoints(events)[0]!;
-
-    const result = await replayCommand(
-      parseArgs([
-        'replay',
-        'last',
-        '--from',
-        String(checkpoint.seq),
-        '--model',
-        'glm-5.3-flash',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    const forkDir = (await resolveRunSelector(workspace, result.forkRunId!)).dir;
-    const forkEvents = await (await TraceReader.open(forkDir)).events();
-    const forkEvent = forkEvents.find((e) => e.type === 'fork');
-    expect(forkEvent?.attrs?.parent_run).toBe(first.runId);
-    expect(forkEvent?.attrs?.fork_point).toBe(checkpoint.seq);
-  });
-
-  it('records the filesystem as a fork runs, so a fork can be forked again', async () => {
-    // A fork used to record only the conversation. A checkpoint is derived from a snapshot
-    // (spec §3), so a fork had no checkpoints and could not be forked — and `agenticreplay compare last`
-    // straight after a fork failed with "this run has no checkpoints", because `last` resolves to
-    // the fork. A branch you cannot branch again is a dead end one step in.
-    const recorded = await record();
-    const checkpoints = deriveCheckpoints(await (await TraceReader.open(recorded.runDir)).events());
-    const first = await replayCommand(
-      parseArgs([
-        'replay',
-        'last',
-        '--from',
-        String(checkpoints[0]!.seq),
-        '--model',
-        'glm-5.3-flash',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-
-    const forkDir = (await resolveRunSelector(workspace, first.forkRunId!)).dir;
-    const forkEvents = await (await TraceReader.open(forkDir)).events();
-    expect(
-      forkEvents.filter((e) => e.type === 'fs.snapshot').length,
-      'the fork recorded no filesystem snapshot',
-    ).toBeGreaterThan(0);
-
-    const forkCheckpoints = deriveCheckpoints(forkEvents);
-    expect(forkCheckpoints.length, 'a fork with no checkpoints cannot be forked').toBeGreaterThan(
-      0,
-    );
-
-    // And the property that actually matters: forking it works.
-    const second = await replayCommand(
-      parseArgs([
-        'replay',
-        first.forkRunId!,
-        '--from',
-        String(forkCheckpoints[0]!.seq),
-        '--model',
-        'claude-haiku-4-5',
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-    expect(second.forkRunId).toBeDefined();
-    expect(second.forkRunId).not.toBe(first.forkRunId);
-    expect(second.exitCode, 'the twice-forked agent must actually run').toBe(0);
-  });
-
-  it('lists both runs afterwards, newest first', async () => {
-    await record();
-    const before = (await listRuns(workspace)).length;
-    const events = await (await TraceReader.open((await listRuns(workspace))[0]!.dir)).events();
-    await replayCommand(
-      parseArgs([
-        'replay',
-        'last',
-        '--from',
-        String(deriveCheckpoints(events)[0]!.seq),
-        '--upstream-anthropic',
-        model.url,
-      ]),
-      out,
-      workspace,
-    );
-    expect((await listRuns(workspace)).length).toBe(before + 1);
-  });
-
-  it('never writes the agent api key into the trace', async () => {
-    process.env.ANTHROPIC_API_KEY = 'sk-e2e-secret-key-should-never-appear-anywhere';
-    try {
-      const result = await record();
-      const raw = await readFile(join(result.runDir, 'events.jsonl'), 'utf8');
-      expect(raw).not.toContain('sk-e2e-secret-key-should-never-appear-anywhere');
-      const manifest = await readFile(join(result.runDir, 'manifest.json'), 'utf8');
-      expect(manifest).not.toContain('sk-e2e-secret-key-should-never-appear-anywhere');
-    } finally {
-      delete process.env.ANTHROPIC_API_KEY;
-    }
-  });
-
-  /**
-   * The edges that make a run answerable in one hop rather than by reading every line. Asserted
-   * against a real recording rather than a fixture, because the seq resolution happens in the
-   * recorder and a unit test of the deriver cannot see it.
-   */
-  describe('causal edges', () => {
-    it('points each tool.call at the model.response that emitted it', async () => {
-      const result = await record();
-      const events = await (await TraceReader.open(result.runDir)).events();
-      const bySeq = new Map(events.map((e) => [e.seq, e]));
-      const calls = events.filter((e) => e.type === 'tool.call');
-
-      expect(calls.length).toBeGreaterThan(0);
-      for (const call of calls) {
-        expect(call.causes, `tool.call seq ${call.seq} names no cause`).toHaveLength(1);
-        expect(bySeq.get(call.causes![0]!)?.type).toBe('model.response');
-      }
-    });
-
-    it('points a model.request at the tool.result it carried back', async () => {
-      const result = await record();
-      const events = await (await TraceReader.open(result.runDir)).events();
-      const bySeq = new Map(events.map((e) => [e.seq, e]));
-      const carrying = events.filter((e) => e.type === 'model.request' && e.causes?.length);
-
-      expect(carrying.length).toBeGreaterThan(0);
-      for (const request of carrying) {
-        for (const cause of request.causes ?? []) {
-          expect(bySeq.get(cause)?.type).toBe('tool.result');
-        }
-      }
-    });
-
-    it('keeps every edge pointing backwards, as spec §2.1 requires of causes', async () => {
-      const result = await record();
-      const events = await (await TraceReader.open(result.runDir)).events();
-      for (const event of events) {
-        for (const cause of event.causes ?? []) expect(cause).toBeLessThan(event.seq);
-      }
-    });
-
-    it('derives the tool call behind a file change without writing that edge to the trace', async () => {
-      const result = await record();
-      const events = await (await TraceReader.open(result.runDir)).events();
-
-      // The recorder must not have written it: a snapshot is per turn, so this is a guess.
-      for (const change of events.filter((e) => e.type === 'fs.change')) {
-        expect(change.causes).toBeUndefined();
-      }
-
-      // The reader derives it anyway, and says that it did.
-      const inferred = runGraph(events).edges.filter((e) => e.kind === 'inferred');
-      expect(inferred.length).toBeGreaterThan(0);
-      const bySeq = new Map(events.map((e) => [e.seq, e]));
-      for (const edge of inferred) {
-        expect(bySeq.get(edge.from)?.type).toBe('tool.call');
-        expect(edge.rule).not.toBe('');
-      }
-    });
-
-    it('walks from a file change back to the model turn that caused it', async () => {
-      const result = await record();
-      const events = await (await TraceReader.open(result.runDir)).events();
-      const change = events.find((e) => e.type === 'fs.change');
-      expect(change).toBeDefined();
-
-      const chain = chainTo(runGraph(events), change!.seq).nodes.map((n) => n.type);
-      expect(chain).toContain('tool.call');
-      expect(chain).toContain('model.response');
-    });
-  });
-});