agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/fixtures/ide-parent.mjs

@@ -1,34 +0,0 @@
-/**
- * An editor that spawns the real agent, which is the shape of Codex-in-the-IDE.
- *
- * The VS Code and Cursor extensions do not make model calls themselves — they run a agent binary
- * as a child process and talk to it over a pipe. AgenticReplay cannot launch that child, because the editor
- * launches it. What agenticreplay can launch is the editor, and everything it needs then reaches the agent
- * by inheritance: `HTTPS_PROXY`, the run CA, and the base-URL variables alike.
- *
- * So this fixture makes no model call of its own. It exists to put one process between agenticreplay and
- * the agent, and to fail loudly if that gap is where the capture environment goes missing.
- */
-import { spawn } from 'node:child_process';
-
-const [, , child, ...rest] = process.argv;
-if (!child) {
-  console.error('ide-parent: needs the agent to spawn');
-  process.exit(2);
-}
-
-console.log('ide-parent: launching the agent, having asked no model anything');
-
-// `env` is deliberately not passed: inheriting the parent's environment untouched is the property
-// under test. Passing `{...process.env}` would test the same thing, but it would also hide a
-// regression where agenticreplay stopped putting the capture into the environment in the first place.
-const agent = spawn(process.execPath, [child, ...rest], { stdio: 'inherit' });
-
-agent.on('exit', (code, signal) => {
-  console.log(`ide-parent: agent exited code=${code ?? 'null'} signal=${signal ?? 'none'}`);
-  process.exit(code ?? 1);
-});
-agent.on('error', (err) => {
-  console.error(`ide-parent: could not spawn the agent: ${String(err)}`);
-  process.exit(3);
-});

package/packages/cli/test/fixtures/mcp-agent.mjs

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-/**
- * A stand-in agent that uses an MCP server, for end-to-end tests.
- *
- * It does the two things that matter to the recorder: it reads its MCP config from the environment
- * (agenticreplay rewrites a copy and points the agent at it), and it talks to the configured stdio server
- * over newline-delimited JSON-RPC — which is what the shim tees.
- *
- * It also drives a model turn either side of the MCP call, and sits for a while before exiting, so
- * a test can tell an event stamped when it happened from one stamped when the frames file was
- * drained. Those are indistinguishable if they are microseconds apart.
- */
-import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-
-const base = process.env.ANTHROPIC_BASE_URL;
-const configPath = process.env.MCP_CONFIG_PATH;
-if (!base || !configPath) {
-  console.error('mcp-agent: ANTHROPIC_BASE_URL and MCP_CONFIG_PATH are both required');
-  process.exit(2);
-}
-
-const messages = [{ role: 'user', content: 'call the echo server' }];
-
-async function modelTurn() {
-  const res = await fetch(`${base}/v1/messages`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', 'x-api-key': 'test-key' },
-    body: JSON.stringify({ model: 'claude-opus-5', max_tokens: 1024, messages }),
-  });
-  const body = await res.json();
-  messages.push({ role: 'assistant', content: body.content });
-  messages.push({ role: 'user', content: 'and again' });
-}
-
-async function mcpCall() {
-  const config = JSON.parse(readFileSync(configPath, 'utf8'));
-  const entry = Object.values(config.mcpServers)[0];
-  const server = spawn(entry.command, entry.args ?? [], { stdio: ['pipe', 'pipe', 'inherit'] });
-  const reply = new Promise((resolve) => {
-    let buf = '';
-    server.stdout.setEncoding('utf8');
-    server.stdout.on('data', (chunk) => {
-      buf += chunk;
-      const at = buf.indexOf('\n');
-      if (at >= 0) resolve(buf.slice(0, at));
-    });
-  });
-  server.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' })}\n`);
-  await reply;
-  server.stdin.end();
-  await new Promise((resolve) => server.on('close', resolve));
-}
-
-// Turn 1, then the MCP call inside it, then turn 2 — so there is a right answer and a wrong one
-// for which turn the call belongs to.
-await modelTurn();
-await mcpCall();
-await modelTurn();
-
-// Keep running. The frames file is drained after this process exits, so without a measurable gap a
-// timestamp taken at the drain and one taken when the call happened look the same.
-await new Promise((resolve) => setTimeout(resolve, 400));
-console.log('mcp-agent: done');

package/packages/cli/test/fixtures/proxy-call.mjs

@@ -1,105 +0,0 @@
-/**
- * A CONNECT-then-TLS call through `HTTPS_PROXY`, shared by the fixture agents.
- *
- * Node's own client does not honour proxy environment variables before v24, so the CONNECT is
- * written by hand — which is also what makes this a test of agenticreplay's proxy rather than of Node's.
- * It lives here because two fixtures need it: the harness that only speaks TLS, and the ordinary
- * agent that has to make one side-call so a *fork* can be checked for interception too.
- */
-import { once } from 'node:events';
-import { existsSync, readFileSync } from 'node:fs';
-import { request as httpRequest } from 'node:http';
-import { connect as tlsConnect } from 'node:tls';
-
-/** The roots this child was given, which is the only trust an intercepted child ever has. */
-export function trustFromEnv() {
-  const trust = [];
-  for (const path of [process.env.NODE_EXTRA_CA_CERTS, process.env.AGENTICREPLAY_TEST_ORIGIN_CA]) {
-    if (path && existsSync(path)) trust.push(readFileSync(path, 'utf8'));
-  }
-  return trust;
-}
-
-export async function callThroughProxy(target, trust = trustFromEnv()) {
-  const proxy = new URL(process.env.HTTPS_PROXY ?? 'http://127.0.0.1:1');
-  const authority = `${target.host}:${target.port}`;
-  const tunnel = httpRequest({
-    host: proxy.hostname,
-    port: Number(proxy.port),
-    method: 'CONNECT',
-    path: authority,
-    headers: { host: authority },
-  });
-  tunnel.end();
-  const [res, socket, head] = await once(tunnel, 'connect');
-  if (res.statusCode !== 200) {
-    socket.destroy();
-    throw new Error(`CONNECT ${authority} → ${res.statusCode}`);
-  }
-  if (head.length > 0) socket.unshift(head);
-
-  const secure = tlsConnect({ socket, ca: trust, host: target.host, port: target.port });
-  await once(secure, 'secureConnect');
-  const issuer = String(secure.getPeerCertificate().issuer.CN ?? '');
-
-  return await new Promise((resolve, reject) => {
-    const req = httpRequest(
-      {
-        createConnection: () => secure,
-        host: target.host,
-        port: target.port,
-        method: target.method ?? 'GET',
-        path: target.path ?? '/',
-        headers: { host: authority, 'content-type': 'application/json' },
-      },
-      (response) => {
-        let body = '';
-        response.setEncoding('utf8');
-        response.on('data', (chunk) => (body += chunk));
-        response.on('end', () => {
-          secure.destroy();
-          resolve({ status: response.statusCode, body, issuer });
-        });
-      },
-    );
-    // Errors are the expected consequence of `leave`, not a failure of the call.
-    req.on('error', (err) => {
-      if (target.leave) return;
-      secure.destroy();
-      reject(err);
-    });
-    // Built here rather than passed in: a body over the capture limit does not fit in the
-    // environment variable that carries these targets, and the point is the size.
-    const body =
-      target.padKb === undefined
-        ? target.body
-        : JSON.stringify({ prompt: 'x'.repeat(target.padKb * 1024) });
-    if (body !== undefined) req.write(body);
-    req.end();
-    if (target.leave) {
-      // The agent got what it came for and stopped reading. One beat first, so the request is on
-      // the wire before the socket goes -- that is what leaves a decrypted request with no
-      // response behind it.
-      setTimeout(() => {
-        secure.destroy();
-        resolve({ status: undefined, body: '', issuer, abandoned: true });
-      }, 150);
-    }
-  });
-}
-
-/** Every target in `AGENTICREPLAY_TEST_TARGETS`, attempted in order, errors captured rather than thrown. */
-export async function callConfiguredTargets(trust = trustFromEnv()) {
-  const targets = process.env.AGENTICREPLAY_TEST_TARGETS
-    ? JSON.parse(process.env.AGENTICREPLAY_TEST_TARGETS)
-    : [];
-  const results = [];
-  for (const target of targets) {
-    try {
-      results.push({ target, ...(await callThroughProxy(target, trust)) });
-    } catch (err) {
-      results.push({ target, error: String(err) });
-    }
-  }
-  return results;
-}

package/packages/cli/test/fixtures/responses-agent.mjs

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-/**
- * A stand-in agent that speaks the OpenAI Responses API, for end-to-end tests.
- *
- * This is the shape the Codex CLI and the OpenAI Agents SDK take: `OPENAI_BASE_URL` for the
- * origin, `POST /v1/responses` for every turn, the whole conversation resent each time as `input`
- * items — which is what lets a proxy in front of it see the entire loop, tool results included.
- *
- * Before the Responses dialect existed, running this under `agenticreplay record` did not produce an empty
- * trace. It produced a dead agent: the proxy answered 404 on turn one.
- */
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-const base = process.env.OPENAI_BASE_URL;
-if (!base) {
-  console.error('responses-agent: OPENAI_BASE_URL is not set');
-  process.exit(2);
-}
-
-const turns = Number(process.env.RESPONSES_AGENT_TURNS ?? '2');
-const cwd = process.cwd();
-const input = [{ role: 'user', content: [{ type: 'input_text', text: 'fix the auth test' }] }];
-
-const tools = [
-  {
-    type: 'function',
-    name: 'edit_file',
-    description: 'Write content to a file',
-    parameters: {
-      type: 'object',
-      properties: { path: { type: 'string' }, content: { type: 'string' } },
-      required: ['path', 'content'],
-    },
-  },
-];
-
-for (let turn = 0; turn < turns; turn += 1) {
-  const res = await fetch(`${base}/responses`, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      authorization: `Bearer ${process.env.OPENAI_API_KEY ?? 'test-key'}`,
-    },
-    body: JSON.stringify({
-      model: process.env.RESPONSES_AGENT_MODEL ?? 'gpt-5.2',
-      instructions: 'You are a careful engineer.',
-      input,
-      tools,
-      max_output_tokens: 1024,
-    }),
-  });
-
-  if (!res.ok) {
-    console.error(`responses-agent: ${res.status} from ${base}/responses`);
-    process.exit(3);
-  }
-
-  const body = await res.json();
-  let calledTool = false;
-  for (const item of body.output ?? []) {
-    if (item.type === 'message') {
-      const text = (item.content ?? []).map((c) => c.text ?? '').join('');
-      if (text) console.log(text);
-      input.push({ role: 'assistant', content: [{ type: 'output_text', text }] });
-    } else if (item.type === 'function_call') {
-      calledTool = true;
-      const args = JSON.parse(item.arguments);
-      writeFileSync(join(cwd, args.path), args.content);
-      input.push({
-        type: 'function_call',
-        call_id: item.call_id,
-        name: item.name,
-        arguments: item.arguments,
-      });
-      input.push({ type: 'function_call_output', call_id: item.call_id, output: 'ok' });
-    }
-  }
-  if (!calledTool) break;
-}
-
-console.log(`responses-agent: completed ${turns} turns`);

package/packages/cli/test/fixtures/responses-model.mjs

@@ -1,94 +0,0 @@
-/**
- * A deterministic stand-in for the OpenAI Responses API.
- *
- * Shaped after what the Agents SDK and the Codex CLI actually put on the wire: `instructions`
- * rather than a system message, tool traffic as top-level `input` items, and an `output` array
- * whose function calls carry both an item id and the `call_id` a later result references.
- *
- * Turn 1 asks for a file edit; later turns end the conversation. Deterministic on purpose — an
- * exact-replay test cannot tell "replay worked" from "the model happened to agree" otherwise.
- */
-import { createServer } from 'node:http';
-
-export async function startResponsesModel(options = {}) {
-  const calls = [];
-  const editContent = options.editContent ?? 'export const fixed = true;\n';
-
-  const server = createServer((req, res) => {
-    const chunks = [];
-    req.on('data', (c) => chunks.push(c));
-    req.on('end', () => {
-      const raw = Buffer.concat(chunks).toString('utf8');
-      let body = {};
-      try {
-        body = JSON.parse(raw);
-      } catch {
-        /* fall through to the default reply */
-      }
-      calls.push({ url: req.url, body });
-
-      const input = Array.isArray(body.input) ? body.input : [];
-      const turn = input.filter((i) => i.type === 'function_call').length;
-      const model = body.model ?? 'gpt-5.2';
-
-      const reply =
-        turn === 0
-          ? {
-              id: `resp_${turn}`,
-              object: 'response',
-              status: 'completed',
-              model,
-              output: [
-                {
-                  type: 'message',
-                  id: `msg_${turn}`,
-                  role: 'assistant',
-                  status: 'completed',
-                  content: [{ type: 'output_text', text: 'editing auth.ts', annotations: [] }],
-                },
-                {
-                  type: 'function_call',
-                  id: `fc_${turn}`,
-                  call_id: `call_${turn}`,
-                  name: 'edit_file',
-                  arguments: JSON.stringify({ path: 'auth.ts', content: editContent }),
-                  status: 'completed',
-                },
-              ],
-              usage: {
-                input_tokens: 100 + turn,
-                output_tokens: 20 + turn,
-                total_tokens: 120 + turn * 2,
-              },
-            }
-          : {
-              id: `resp_${turn}`,
-              object: 'response',
-              status: 'completed',
-              model,
-              output: [
-                {
-                  type: 'message',
-                  id: `msg_${turn}`,
-                  role: 'assistant',
-                  status: 'completed',
-                  content: [{ type: 'output_text', text: 'done', annotations: [] }],
-                },
-              ],
-              usage: { input_tokens: 100 + turn, output_tokens: 5, total_tokens: 105 + turn },
-            };
-
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify(reply));
-    });
-  });
-
-  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const { port } = server.address();
-  return {
-    port,
-    url: `http://127.0.0.1:${port}`,
-    calls,
-    close: () => new Promise((resolve) => server.close(resolve)),
-  };
-}

package/packages/cli/test/fixtures/tls-agent.mjs

@@ -1,35 +0,0 @@
-/**
- * A stand-in for a harness that ignores base-URL variables and talks HTTPS to its own backend.
- *
- * It does what such a harness does: read `HTTPS_PROXY`, `CONNECT` through it, and speak TLS on the
- * tunnel. Node's own client does not honour proxy environment variables before v24, so the CONNECT
- * is written by hand here — which is also what makes this a test of agenticreplay's proxy rather than of
- * Node's.
- *
- * Everything it reports goes to files named in the environment, so the test can assert on what the
- * *child* saw rather than on what the parent believes it set.
- */
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { callConfiguredTargets } from './proxy-call.mjs';
-
-if (process.env.AGENTICREPLAY_TEST_ENV_OUT) {
-  writeFileSync(process.env.AGENTICREPLAY_TEST_ENV_OUT, JSON.stringify(process.env, null, 2));
-}
-
-// The run CA's private key, copied out by the child exactly as an attacker with the agent's own
-// privileges could. The test greps the finished trace for these bytes.
-if (process.env.AGENTICREPLAY_TEST_CA_KEY_OUT && process.env.NODE_EXTRA_CA_CERTS) {
-  const keyPath = process.env.NODE_EXTRA_CA_CERTS.replace(/ca\.crt$/, 'ca.key');
-  if (existsSync(keyPath))
-    writeFileSync(process.env.AGENTICREPLAY_TEST_CA_KEY_OUT, readFileSync(keyPath));
-}
-
-const trust = [];
-for (const path of [process.env.NODE_EXTRA_CA_CERTS, process.env.AGENTICREPLAY_TEST_ORIGIN_CA]) {
-  if (path && existsSync(path)) trust.push(readFileSync(path, 'utf8'));
-}
-
-const results = await callConfiguredTargets(trust);
-if (process.env.AGENTICREPLAY_TEST_RESULT_OUT) {
-  writeFileSync(process.env.AGENTICREPLAY_TEST_RESULT_OUT, JSON.stringify(results, null, 2));
-}

package/packages/cli/test/fixtures/vercel-agent.mjs

@@ -1,81 +0,0 @@
-#!/usr/bin/env node
-/**
- * A stand-in for an agent built on the Vercel AI SDK.
- *
- * The one property that matters is what it does *not* do: it reads no base-URL variable. It
- * holds `https://api.openai.com` in code, the way any agent does once a gateway is pinned in
- * source. Under every other adapter that makes it invisible to agenticreplay — the run succeeds, exits
- * 0, and the trace is empty.
- *
- * It also hands `fetch` a `Request` object rather than a string on its second turn, because the
- * SDKs that do this are exactly the ones that would slip past a hook that only rewrites strings.
- */
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-const ORIGIN = 'https://api.openai.com';
-const cwd = process.cwd();
-const input = [{ role: 'user', content: [{ type: 'input_text', text: 'fix the auth test' }] }];
-const tools = [
-  {
-    type: 'function',
-    name: 'edit_file',
-    description: 'Write content to a file',
-    parameters: {
-      type: 'object',
-      properties: { path: { type: 'string' }, content: { type: 'string' } },
-      required: ['path', 'content'],
-    },
-  },
-];
-
-const body = () =>
-  JSON.stringify({ model: 'gpt-5.2', instructions: 'You are a careful engineer.', input, tools });
-
-for (let turn = 0; turn < 2; turn += 1) {
-  const url = `${ORIGIN}/v1/responses`;
-  const init = {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: body(),
-    // Without this the control run — no hook installed — waits on a connection that will never
-    // be made, and a test that hangs teaches nobody anything.
-    signal: AbortSignal.timeout(Number(process.env.VERCEL_AGENT_TIMEOUT_MS ?? '4000')),
-  };
-
-  let res;
-  try {
-    // Turn 2 goes through a Request object, the way an SDK's own fetch wrapper builds one.
-    res = turn === 0 ? await fetch(url, init) : await fetch(new Request(url, init));
-  } catch (err) {
-    console.error(`vercel-agent: could not reach ${ORIGIN} (${err.name})`);
-    process.exit(0);
-  }
-  if (!res.ok) {
-    console.error(`vercel-agent: ${res.status} from ${url}: ${(await res.text()).slice(0, 300)}`);
-    process.exit(3);
-  }
-
-  let calledTool = false;
-  for (const item of (await res.json()).output ?? []) {
-    if (item.type === 'message') {
-      const text = (item.content ?? []).map((c) => c.text ?? '').join('');
-      if (text) console.log(text);
-      input.push({ role: 'assistant', content: [{ type: 'output_text', text }] });
-    } else if (item.type === 'function_call') {
-      calledTool = true;
-      const args = JSON.parse(item.arguments);
-      writeFileSync(join(cwd, args.path), args.content);
-      input.push({
-        type: 'function_call',
-        call_id: item.call_id,
-        name: item.name,
-        arguments: item.arguments,
-      });
-      input.push({ type: 'function_call_output', call_id: item.call_id, output: 'ok' });
-    }
-  }
-  if (!calledTool) break;
-}
-
-console.log('vercel-agent: done');

package/packages/cli/test/flag-values.test.ts

@@ -1,162 +0,0 @@
-import { readFileSync, readdirSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { describe, expect, it } from 'vitest';
-import { NUMERIC, VALUELESS, parseArgs } from '../src/args.js';
-import { assertKnownFlags } from '../src/flags.js';
-
-/**
- * A flag whose value the parser could not honour.
- *
- * `assertKnownFlags` settled the names: an invented flag is refused rather than ignored. The values
- * were still taken on trust, and every accessor falls back silently when one is missing or of the
- * wrong shape — so the instruction disappeared and the run reported success having done something
- * else. Four shapes, all of them things a person actually types:
- *
- *   agenticreplay replay last --model            the value forgotten, or eaten by the shell
- *   agenticreplay scrub last --match a --match b the flag repeated, because that is how most CLIs take a list
- *   agenticreplay replay last --from four        a word where a number goes
- *   agenticreplay replay last --json=maybe       a value on a flag that is only ever on or off
- *
- * `agenticreplay gc --keep` already checked its own by hand, which is the argument for doing it here: one
- * command got it right and the other nine did not, and nothing made that visible.
- */
-describe('flags whose value cannot be honoured', () => {
-  const check = (argv: string[]) => () => assertKnownFlags(parseArgs(argv));
-
-  describe('a value that was not given', () => {
-    it('refuses a value-taking flag left empty at the end of the line', () => {
-      expect(check(['replay', 'last', '--model'])).toThrow(/--model needs a value/);
-    });
-
-    it('refuses one whose value is the next flag, which is the same mistake', () => {
-      expect(check(['replay', 'last', '--model', '--json'])).toThrow(/--model needs a value/);
-    });
-
-    /**
-     * The silent version of this one changed what the command did: `--model` set nothing, so the
-     * fork the person asked for became a plain replay of the run they already had, and the two
-     * "different models" agreed because only one of them ever ran.
-     */
-    it('says what the flag is for, so the message is enough to act on', () => {
-      expect(check(['replay', 'last', '--from'])).toThrow(/--from needs a number/);
-    });
-
-    it('leaves a flag given a real value alone', () => {
-      expect(check(['replay', 'last', '--model', 'x'])).not.toThrow();
-      expect(check(['replay', 'last', '--model=x'])).not.toThrow();
-      // An explicitly empty value is a value: the person said so.
-      expect(check(['replay', 'last', '--model='])).not.toThrow();
-    });
-
-    /** A negation is not a missing value; it is the value `false`. */
-    it('leaves a negated flag alone', () => {
-      expect(check(['record', 'claude', '--no-fs'])).not.toThrow();
-    });
-
-    /** And a flag that never takes one is not missing anything. */
-    it('leaves a valueless flag alone', () => {
-      expect(check(['replay', 'last', '--json', '--quiet'])).not.toThrow();
-    });
-  });
-
-  describe('a flag given twice', () => {
-    /**
-     * Repeating a flag is how most CLIs take a list, so people write it. Here the second assignment
-     * overwrote the first without a word: `agenticreplay scrub last --match a --match b --match c` redacted
-     * only `c`, and reported the count for `c` as though that were the whole job.
-     */
-    it('refuses conflicting repeats rather than keeping the last', () => {
-      expect(check(['scrub', 'last', '--match', 'a', '--match', 'b'])).toThrow(
-        /--match given more than once/,
-      );
-    });
-
-    it('points at the form that does take a list', () => {
-      expect(check(['scrub', 'last', '--match', 'a', '--match', 'b'])).toThrow(/--matches a,b/);
-    });
-
-    it('catches the equals form and the mixture too', () => {
-      expect(check(['scrub', 'last', '--match=a', '--match=b'])).toThrow(/given more than once/);
-      expect(check(['scrub', 'last', '--match', 'a', '--match=b'])).toThrow(/given more than once/);
-    });
-
-    /** Repeating a flag with the same value asks for nothing contradictory, so it is allowed. */
-    it('allows a repeat that says the same thing twice', () => {
-      expect(check(['scrub', 'last', '--match', 'a', '--match', 'a'])).not.toThrow();
-      expect(check(['replay', 'last', '--json', '--json'])).not.toThrow();
-    });
-  });
-
-  describe('a value of the wrong shape', () => {
-    /**
-     * `num()` returns its fallback for a word, so `--from four` replayed the whole run instead of
-     * forking at a checkpoint, and `--port four` bound a random port and printed it as though that
-     * had been the request.
-     */
-    it('refuses a word where a number belongs', () => {
-      expect(check(['replay', 'last', '--from', 'four'])).toThrow(/--from needs a number/);
-      expect(check(['ui', 'last', '--port', 'eighty'])).toThrow(/--port needs a number/);
-    });
-
-    it('takes a number in either form, including a negative one', () => {
-      expect(check(['replay', 'last', '--from', '4'])).not.toThrow();
-      expect(check(['replay', 'last', '--from=4'])).not.toThrow();
-      expect(check(['replay', 'last', '--from', '-1'])).not.toThrow();
-    });
-
-    /**
-     * `bool()` returns its fallback for a string, so `--json=maybe` turned JSON output *off* while
-     * the person was asking for it — and a script reading stdout got a human table.
-     */
-    it('refuses a value on a flag that is only ever on or off', () => {
-      expect(check(['replay', 'last', '--json=maybe'])).toThrow(/--json takes no value/);
-    });
-
-    it('allows the spellings that do mean on and off', () => {
-      expect(check(['replay', 'last', '--json'])).not.toThrow();
-      expect(check(['replay', 'last', '--json=true'])).not.toThrow();
-      expect(check(['replay', 'last', '--no-json'])).not.toThrow();
-    });
-  });
-
-  /**
-   * The three sets are the whole of the classification, and a flag read one way and declared
-   * another is a hole in it. Read from the source, because a hand-kept list drifts the moment the
-   * code moves — which is exactly how `--quiet` and `--full` came to be missing from `VALUELESS`.
-   */
-  describe('the classification against the source it mirrors', () => {
-    const SRC = join(dirname(fileURLToPath(import.meta.url)), '..', 'src');
-
-    function readAs(accessor: string): Set<string> {
-      const found = new Set<string>();
-      const walk = (dir: string): void => {
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-          const path = join(dir, entry.name);
-          if (entry.isDirectory()) walk(path);
-          else if (entry.name.endsWith('.ts')) {
-            const re = new RegExp(`args\\.(?:${accessor})\\('([^']+)'`, 'g');
-            for (const m of readFileSync(path, 'utf8').matchAll(re)) found.add(m[1]!);
-          }
-        }
-      };
-      walk(SRC);
-      return found;
-    }
-
-    it('declares every flag the code reads as a number', () => {
-      const missing = [...readAs('num')].filter((n) => !NUMERIC.has(n)).sort();
-      expect(missing).toEqual([]);
-    });
-
-    it('never declares a flag both valueless and numeric', () => {
-      const both = [...NUMERIC].filter((n) => VALUELESS.has(n)).sort();
-      expect(both).toEqual([]);
-    });
-
-    it('never declares a numeric flag that the code reads as a string or a list', () => {
-      const contradictory = [...readAs('str|list')].filter((n) => NUMERIC.has(n)).sort();
-      expect(contradictory).toEqual([]);
-    });
-  });
-});