agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/nested-repo-replay.test.ts

@@ -1,972 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { TraceReader, deriveCheckpoints, type TraceWriter } from '@agenticreplay/core';
-import { FsCapture } from '@agenticreplay/fs-capture';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { parseArgs } from '../src/args.js';
-import { assertResettable, assertRestorable, replayCommand } from '../src/commands/replay.js';
-import { recordCommand } from '../src/commands/record.js';
-import { appendSnapshot } from '../src/fs-events.js';
-import { Output, type LogEntry } from '../src/out.js';
-import { startFakeModel } from './fixtures/fake-model.mjs';
-
-const exec = promisify(execFile);
-// Filesystem-only fixture agents intentionally make no HTTP requests. The recorder correctly
-// exits 2 for absent capture; these tests inspect filesystem restore and process teardown.
-const run: typeof exec = (async (...args: Parameters<typeof exec>) => {
-  try {
-    return await exec(...args);
-  } catch (error) {
-    const failure = error as { code?: number; stdout?: string; stderr?: string };
-    if (
-      failure.code === 2 &&
-      failure.stdout?.includes('capture.empty') &&
-      args[1]?.includes('record')
-    )
-      return { stdout: failure.stdout, stderr: failure.stderr ?? '' };
-    throw error;
-  }
-}) as typeof exec;
-const here = dirname(fileURLToPath(import.meta.url));
-const cli = join(here, '..', 'dist', 'cli.js');
-const FAKE_AGENT = join(here, 'fixtures', 'fake-agent.mjs');
-
-/** A repository that can commit on a machine with no global git identity. */
-async function initRepo(dir: string): Promise<void> {
-  await run('git', ['init', '-q'], { cwd: dir });
-  await run('git', ['config', 'user.email', 'test@example.com'], { cwd: dir });
-  await run('git', ['config', 'user.name', 'Test'], { cwd: dir });
-}
-
-/** A repository inside another one, which is what `git add` stores as a gitlink. */
-async function nestRepo(parent: string, path: string): Promise<string> {
-  const dir = join(parent, ...path.split('/'));
-  await mkdir(dir, { recursive: true });
-  await initRepo(dir);
-  await writeFile(join(dir, 'inside.txt'), 'held by the nested repo');
-  await run('git', ['add', '-A'], { cwd: dir });
-  await run('git', ['commit', '-qm', 'nested'], { cwd: dir });
-  return dir;
-}
-
-/** An agent that leaves a mark on the workspace and exits, needing no model to do it. */
-const QUIET_AGENT = [
-  "import { writeFileSync } from 'node:fs';",
-  "writeFileSync(new URL('./output.txt', import.meta.url), 'written by the agent');",
-  "process.stdout.write('HI');",
-].join('\n');
-
-/**
- * Which nested repositories stop a replay, and which are simply left where they are.
- *
- * A snapshot records a nested repository as a gitlink and never holds its contents, so a restore
- * cannot put one back. Whether that matters depends entirely on whether the replay took it away
- * first: `resetArtifacts` deletes the adapter's declared reset paths before restoring, and a
- * corpus cloned into `cache/` is gone for good — but where nothing is deleted, `materialize`
- * writes the tree's files and leaves everything else alone, so the repository is still sitting
- * there, untouched, when the restore finishes.
- *
- * Refusing both cases is issue #103: `claude`, like every adapter but `indexrag`, declares no
- * reset paths, so every recording it made in a workspace holding a submodule or a vendored
- * checkout could not be replayed at all.
- */
-describe('assertRestorable', () => {
-  const artifacts = (resetBeforeReplay: string[]) => ({ resetBeforeReplay });
-  let dir: string;
-  let capture: FsCapture;
-  let tree: string;
-
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-guard-'));
-    await initRepo(dir);
-    // One where an adapter could be told to delete the directory around it, one where it could not.
-    await nestRepo(dir, 'cache/corpus');
-    await nestRepo(dir, 'tools/vendored');
-    // A real capture, so the gitlinks are the ones `git add` decides to write rather than a shape
-    // this test made up — the guard's whole input is what git chose to store.
-    capture = await FsCapture.start({ runDir: join(dir, '.agenticreplay-run'), cwd: dir });
-    tree = (await capture.snapshotTurn(0)).tree;
-  });
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  it('lets a replay that deletes nothing go ahead, and says what it is leaving alone', async () => {
-    await expect(assertRestorable(capture, tree, dir, undefined)).resolves.toEqual([
-      'cache/corpus',
-      'tools/vendored',
-    ]);
-  });
-
-  it('refuses when the replay would delete the repository it cannot then put back', async () => {
-    await expect(assertRestorable(capture, tree, dir, artifacts(['cache']))).rejects.toThrow(
-      /cannot put cache\/corpus back/,
-    );
-  });
-
-  it('names the repositories at risk, and not the ones that are not', async () => {
-    const message = await assertRestorable(capture, tree, dir, artifacts(['cache'])).then(
-      () => 'it did not refuse',
-      (error: Error) => error.message,
-    );
-    expect(message).toContain('cache/corpus');
-    expect(message).not.toContain('tools/vendored');
-  });
-
-  it('refuses when the reset path is the repository itself', async () => {
-    await expect(assertRestorable(capture, tree, dir, artifacts(['cache/corpus']))).rejects.toThrow(
-      /cannot put cache\/corpus back/,
-    );
-  });
-
-  it('compares whole path segments, so a shorter name is not read as a parent', async () => {
-    // `'cache/corpus'.startsWith('cach')` is true and means nothing: `rm -rf <cwd>/cach` does not
-    // touch `cache/`. A prefix test without the separator refuses replays that were never at risk,
-    // which is the bug this whole function is a narrowing of.
-    await expect(assertRestorable(capture, tree, dir, artifacts(['cach']))).resolves.toHaveLength(
-      2,
-    );
-    await expect(assertRestorable(capture, tree, dir, artifacts(['too']))).resolves.toHaveLength(2);
-  });
-
-  it('normalizes the declared path the way the deletion does, before comparing', async () => {
-    // `resetArtifacts` deletes `resolve(dir, root)`; the containment test compares the declared
-    // string. For anything but a clean relative path the two disagree — and it is the guard that
-    // must not, because the `rm` happens either way. Every form below removes `<dir>/cache`.
-    for (const declared of ['./cache', 'tools/../cache', 'cache/./']) {
-      await expect(
-        assertRestorable(capture, tree, dir, artifacts([declared])),
-        declared,
-      ).rejects.toThrow(/cannot put cache\/corpus back/);
-    }
-  });
-
-  it.runIf(process.platform === 'win32')(
-    'compares case the way the filesystem does, where the filesystem does not care',
-    async () => {
-      // `rm -rf <dir>/Cache` on Windows removes `cache`, and git treats the two as one path.
-      // A case-sensitive prefix test therefore calls a corpus safe and then deletes it.
-      await expect(assertRestorable(capture, tree, dir, artifacts(['Cache']))).rejects.toThrow(
-        /cannot put cache\/corpus back/,
-      );
-    },
-  );
-
-  it('refuses when the reset path is inside the repository, not the other way round', async () => {
-    // The mirror image of the case above, and the one a containment test written in the obvious
-    // direction misses. `resetBeforeReplay: ['data/cache']` — a multi-segment declaration, which
-    // `resetRoots` exists to support — with a nested repository at `data`. The reset deletes a
-    // path *inside* the operator's repository.
-    //
-    // Nothing else catches it. `assertResettable` asks `uncaptured(['data/cache'])`, and git does
-    // not look inside an embedded repository, so that comes back empty and it passes. The replay
-    // then removes `data/cache`, restores with `allowIncomplete`, and neither the recording nor
-    // the safety copy holds a byte of it — gone for good, under exit 0.
-    const nest = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-ancestor-'));
-    try {
-      await initRepo(nest);
-      await nestRepo(nest, 'data');
-      await mkdir(join(nest, 'data', 'cache'), { recursive: true });
-      await writeFile(join(nest, 'data', 'cache', 'index.bin'), 'the index the pipeline built');
-      const inner = await FsCapture.start({ runDir: join(nest, '.agenticreplay-run'), cwd: nest });
-      const snapshot = await inner.snapshotTurn(0);
-      // The gitlink really is the ancestor, not the reset path itself.
-      expect(await inner.gitlinks(snapshot.tree)).toEqual(['data']);
-      await expect(
-        assertRestorable(inner, snapshot.tree, nest, artifacts(['data/cache'])),
-      ).rejects.toThrow(/cannot put data back/);
-    } finally {
-      await rm(nest, { recursive: true, force: true });
-    }
-  });
-
-  it('has nothing to say about a workspace that holds no nested repository', async () => {
-    const plain = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-plain-'));
-    try {
-      await initRepo(plain);
-      await writeFile(join(plain, 'notes.md'), 'ordinary work');
-      const ordinary = await FsCapture.start({
-        runDir: join(plain, '.agenticreplay-run'),
-        cwd: plain,
-      });
-      const snapshot = await ordinary.snapshotTurn(0);
-      await expect(
-        assertRestorable(ordinary, snapshot.tree, plain, artifacts(['cache'])),
-      ).resolves.toEqual([]);
-    } finally {
-      await rm(plain, { recursive: true, force: true });
-    }
-  });
-});
-
-/**
- * The same thing from outside, with an adapter that declares no artifacts — which is all of them
- * but `indexrag`, and so is the case the issue was filed from.
- *
- * Every assertion below failed before: the replay exited 1 without running the agent, and did it
- * from inside the safety net rather than before it, so it printed `replay.restore_failed` telling
- * the operator their files were "in that store and were not put back" — of a working tree nothing
- * had touched — and left a copy of the whole workspace behind in the temp directory.
- */
-/**
- * THE SAME QUESTION, OF A REPOSITORY GIT COULD NOT NAME.
- *
- * `assertRestorable` above asks it of the recording's gitlinks. One with no commit is in no tree,
- * so that guard never sees it — and `uncaptured` does not either: `ls-files --others` does not
- * descend into an embedded repository, so a reset root INSIDE one comes back empty. Measured on
- * the workspace these build: empty for `data/cache`, `data/` for `data`.
- *
- * That gap only became reachable when the snapshot stopped throwing on a commit-less repository:
- * before, a replay in such a workspace exited long before the reset. So the guard has to arrive
- * with it, and it is `assertResettable` that can ask, because the safety copy is the only thing
- * that ever names one.
- */
-describe('assertResettable, with a nested repository that has no commit', () => {
-  const artifacts = (resetBeforeReplay: string[]) => ({ resetBeforeReplay });
-  let dir: string;
-  let safety: FsCapture;
-
-  /** `git init` and files, nothing committed — the state git cannot make a gitlink of. */
-  async function startProject(rel: string): Promise<void> {
-    const at = join(dir, ...rel.split('/'));
-    await mkdir(at, { recursive: true });
-    await initRepo(at);
-    await writeFile(join(at, 'notes.md'), 'work of my own');
-    await mkdir(join(at, 'cache'), { recursive: true });
-    await writeFile(join(at, 'cache', 'mine.bin'), 'also mine, and in nobody’s snapshot');
-  }
-
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-nc-guard-'));
-    await initRepo(dir);
-    await writeFile(join(dir, 'README.md'), 'the outer project');
-    await startProject('data');
-    // A real capture over the real workspace: what the guard reads is what `git add` decided,
-    // not a shape this test made up.
-    safety = await FsCapture.start({ runDir: join(dir, '.agenticreplay-run'), cwd: dir });
-    await safety.snapshotTurn(0);
-  });
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  it('is named by the snapshot at all, which is what the guard has to read', async () => {
-    expect(safety.uncommittedNested).toEqual(['data']);
-  });
-
-  /** The direction `uncaptured` cannot see: the reset reaches INSIDE the repository. */
-  it('refuses a reset path inside it, which nothing else catches', async () => {
-    await expect(safety.uncaptured(['data/cache'])).resolves.toEqual([]);
-    await expect(assertResettable(safety, dir, artifacts(['data/cache']))).rejects.toThrow(
-      /cannot put data back/,
-    );
-  });
-
-  it('refuses a reset path that is the repository itself', async () => {
-    await expect(assertResettable(safety, dir, artifacts(['data']))).rejects.toThrow(
-      /cannot put data back/,
-    );
-  });
-
-  it('refuses a reset path the repository sits inside', async () => {
-    await startProject('build/scratch');
-    await safety.snapshotTurn(1);
-    await expect(assertResettable(safety, dir, artifacts(['build']))).rejects.toThrow(
-      /build\/scratch/,
-    );
-  });
-
-  it('says nothing has been deleted, and how to get past it', async () => {
-    const message = await assertResettable(safety, dir, artifacts(['data/cache'])).then(
-      () => 'it did not refuse',
-      (error: Error) => error.message,
-    );
-    expect(message).toContain('Nothing has been deleted');
-    expect(message).toContain('--in-place');
-  });
-
-  /**
-   * Whole segments, the same as the gitlink guard: `rm -rf <cwd>/dat` does not touch `data/`, and
-   * a prefix test without the separator refuses replays that were never at risk.
-   */
-  it('compares whole path segments, so a shorter name is not read as a parent', async () => {
-    await expect(assertResettable(safety, dir, artifacts(['dat']))).resolves.toBeUndefined();
-    await expect(assertResettable(safety, dir, artifacts(['database']))).resolves.toBeUndefined();
-  });
-
-  /**
-   * Spelled the way the filesystem spells it. Windows and macOS fold case, so `Data` and
-   * `data/cache` are the same two directories there and the reset really does reach in; Linux does
-   * not, so they are different directories and refusing would be crying wolf. `fold` is what makes
-   * the guard say the same thing the `rm` will do, on each.
-   */
-  it('folds case where the filesystem does, and not where it does not', async () => {
-    await rm(join(dir, 'data'), { recursive: true, force: true });
-    await startProject('Data');
-    await safety.snapshotTurn(1);
-    expect(safety.uncommittedNested).toContain('Data');
-
-    const verdict = assertResettable(safety, dir, artifacts(['data/cache']));
-    if (process.platform === 'win32' || process.platform === 'darwin') {
-      await expect(verdict).rejects.toThrow(/cannot put Data back/);
-    } else {
-      await expect(verdict).resolves.toBeUndefined();
-    }
-  });
-
-  it('lets a reset that cannot reach it go ahead', async () => {
-    await mkdir(join(dir, 'cache'), { recursive: true });
-    await writeFile(join(dir, 'cache', 'built.bin'), 'the run built this');
-    await safety.snapshotTurn(1);
-    await expect(assertResettable(safety, dir, artifacts(['cache']))).resolves.toBeUndefined();
-  });
-});
-
-/**
- * A DECLARED ARTIFACT PATH INSIDE A NESTED REPOSITORY — `resetBeforeReplay: ['data/cache']` with
- * the operator's own project at `data`.
- *
- * Git stages nothing inside another repository, and before the forced add set such a path aside
- * it answered in two ways, both of them wrong for agenticreplay:
- *
- *   committed, not ignored   the forced add died on "Pathspec 'data/cache' is in submodule 'data'"
- *                            — every snapshot of a recording, and the safety copy of a replay,
- *                            after its `agenticreplay-safety-*` directory already existed
- *   ignored, or no commit    the forced add exited 0 having staged nothing, and a replay whose
- *                            reset reached `data/cache` deleted it under exit 0, having printed
- *                            "your files are restored when the replay ends"
- *
- * No bundled adapter declares a path that deep, so these drive the two functions the CLI runs —
- * `appendSnapshot` while recording and `assertResettable` before a reset — over a real capture of
- * a real workspace.
- */
-describe('a declared artifact path inside a nested repository', () => {
-  const artifacts = (resetBeforeReplay: string[]) => ({ resetBeforeReplay });
-  let dir: string;
-
-  /** The operator's project at `data`, with their work under `data/cache/`. */
-  async function project(committed: boolean): Promise<void> {
-    const at = join(dir, 'data');
-    await mkdir(join(at, 'cache'), { recursive: true });
-    await initRepo(at);
-    await writeFile(join(at, 'notes.md'), 'work of my own');
-    await writeFile(join(at, 'cache', 'mine.bin'), 'also mine, and in nobody’s snapshot');
-    if (committed) {
-      await run('git', ['add', '-A'], { cwd: at });
-      await run('git', ['commit', '-qm', 'mine'], { cwd: at });
-    }
-  }
-
-  /** The copy a replay takes: forced over what the adapter captures and resets. */
-  async function capture(forced: string[]): Promise<FsCapture> {
-    return FsCapture.start({ runDir: join(dir, '.agenticreplay-run'), cwd: dir, forced });
-  }
-
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-inside-'));
-    await initRepo(dir);
-    await writeFile(join(dir, 'README.md'), 'the outer project');
-  });
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  describe('while recording', () => {
-    async function record(forced: string[]): Promise<{ text: string; types: string[] }> {
-      const lines: string[] = [];
-      const types: string[] = [];
-      const out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-      // Only `append` is used; what matters is what the snapshot wrote, not how a trace stores it.
-      const writer = {
-        append: async (event: { type: string }) => void types.push(event.type),
-      } as unknown as TraceWriter;
-      await appendSnapshot(await capture(forced), writer, out, 0, { initial: true });
-      return { text: lines.join(''), types };
-    }
-
-    it('keeps the snapshot a committed one used to cost every turn', async () => {
-      await project(true);
-      const { text, types } = await record(['data/cache']);
-      expect(text).not.toContain('fs.snapshot_failed');
-      expect(types).toContain('fs.snapshot');
-    });
-
-    it('says which declared path it could not hold, and whose repository it is in', async () => {
-      await writeFile(join(dir, '.gitignore'), 'data/\n');
-      await project(true);
-      const { text } = await record(['data/cache']);
-      // Silent before: nothing failed, and nothing said the artifact was not in the recording.
-      expect(text).toContain('fs.artifact_inside_repository');
-      expect(text).toContain('paths=data/cache');
-      expect(text).toContain('inside=data');
-    });
-  });
-
-  describe('before a reset', () => {
-    /** The case that deleted the operator's work: nothing else sees a repository around the root. */
-    it('refuses a reset path inside one the workspace ignores', async () => {
-      await writeFile(join(dir, '.gitignore'), 'data/\n');
-      await project(true);
-      const safety = await capture(['data/cache']);
-      await safety.snapshotTurn(0);
-
-      // Pinned so the reason is on the page: neither question the other guards ask sees it.
-      await expect(safety.uncaptured(['data/cache'])).resolves.toEqual([]);
-      expect(safety.uncommittedNested).toEqual([]);
-      await expect(assertResettable(safety, dir, artifacts(['data/cache']))).rejects.toThrow(
-        /cannot put data back/,
-      );
-    });
-
-    it('refuses one that is committed and not ignored, which used to die inside git', async () => {
-      await project(true);
-      const safety = await capture(['data/cache']);
-      // The throw this replaces came from right here, after `agenticreplay-safety-*` already existed.
-      await expect(safety.snapshotTurn(0)).resolves.toBeDefined();
-      await expect(assertResettable(safety, dir, artifacts(['data/cache']))).rejects.toThrow(
-        /cannot put data back/,
-      );
-    });
-
-    it('refuses one with no commit under an ignored path', async () => {
-      await writeFile(join(dir, '.gitignore'), 'data/\n');
-      await project(false);
-      const safety = await capture(['data/cache']);
-      await safety.snapshotTurn(0);
-      await expect(assertResettable(safety, dir, artifacts(['data/cache']))).rejects.toThrow(
-        /cannot put data back/,
-      );
-    });
-
-    /**
-     * It used to say "commit inside them", which never helped: a committed repository is a gitlink,
-     * whose contents no snapshot holds either, so the same reset is refused the same way — as the
-     * committed cases above show.
-     */
-    it('does not tell the operator to commit inside it', async () => {
-      await project(false);
-      const safety = await capture(['data/cache']);
-      await safety.snapshotTurn(0);
-      const message = await assertResettable(safety, dir, artifacts(['data/cache'])).then(
-        () => 'it did not refuse',
-        (error: Error) => error.message,
-      );
-      expect(message).toContain('Nothing has been deleted');
-      expect(message).not.toMatch(/commit inside/i);
-    });
-
-    it('lets a reset that reaches only other paths go ahead', async () => {
-      await writeFile(join(dir, '.gitignore'), 'data/\ncache/\n');
-      await project(true);
-      await mkdir(join(dir, 'cache'), { recursive: true });
-      await writeFile(join(dir, 'cache', 'index.bin'), 'the run built this');
-      // `data/cache` is captured-only here; the reset is `cache`, which holds no repository.
-      const safety = await capture(['data/cache', 'cache']);
-      await safety.snapshotTurn(0);
-      await expect(assertResettable(safety, dir, artifacts(['cache']))).resolves.toBeUndefined();
-    });
-  });
-});
-
-describe('agenticreplay replay, in a workspace holding a nested git repository', () => {
-  const timeout = 120_000;
-  const nested = ['tools', 'nested-repo'];
-  let dir: string;
-  let scratch: string;
-  let env: NodeJS.ProcessEnv;
-  let runId: string;
-
-  beforeEach(async () => {
-    // A temp dir of this test's own: the safety copy is made under it, so one left behind can be
-    // counted rather than guessed at from a directory shared with every other run on the machine.
-    scratch = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-tmp-'));
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-ws-'));
-    env = { ...process.env, NO_COLOR: '1', TMPDIR: scratch, TMP: scratch, TEMP: scratch };
-
-    await initRepo(dir);
-    await nestRepo(dir, nested.join('/'));
-    await writeFile(join(dir, 'output.txt'), 'as the recording started');
-    await writeFile(join(dir, 'a.mjs'), QUIET_AGENT);
-    await run(process.execPath, [cli, 'record', 'node', '--', 'node', 'a.mjs'], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    });
-    [runId] = (await readdir(join(dir, '.agenticreplay', 'runs'))) as [string];
-    // What the operator has in front of them when they ask for the replay: their own work, on top
-    // of what the recorded agent left behind.
-    await writeFile(join(dir, 'output.txt'), 'my own uncommitted edit');
-  }, timeout);
-
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-    await rm(scratch, { recursive: true, force: true });
-  });
-
-  /** The exit code matters as much as the output, so a rejection is read rather than thrown on. */
-  async function replay(...argv: string[]): Promise<{ code: number; out: string }> {
-    const result = (await run(process.execPath, [cli, 'replay', runId, ...argv], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    }).catch((error: unknown) => error)) as { code?: number; stdout?: string; stderr?: string };
-    return { code: result.code ?? 0, out: `${result.stdout ?? ''}${result.stderr ?? ''}` };
-  }
-
-  const safetyCopies = async (): Promise<string[]> =>
-    (await readdir(scratch)).filter((entry) => entry.startsWith('agenticreplay-safety-'));
-
-  it(
-    'replays it, keeps the repository, and puts the operator’s own tree back',
-    async () => {
-      const { code, out } = await replay();
-      expect(code, out).toBe(0);
-      expect(out).toContain('replay.nested_kept');
-      expect(out).toContain('tools/nested-repo');
-      expect(out).not.toContain('replay.restore_failed');
-
-      expect(await readFile(join(dir, ...nested, 'inside.txt'), 'utf8')).toBe(
-        'held by the nested repo',
-      );
-      await expect(readdir(join(dir, ...nested, '.git'))).resolves.not.toHaveLength(0);
-      // The safety net's whole promise, and the one the false refusal broke: what the operator had
-      // when they ran the command is what they have when it finishes.
-      expect(await readFile(join(dir, 'output.txt'), 'utf8')).toBe('my own uncommitted edit');
-      expect(await safetyCopies()).toEqual([]);
-    },
-    timeout,
-  );
-
-  it(
-    'names a repository the operator added since the recording, which only the copy knows about',
-    async () => {
-      // The gap belongs to whichever tree holds the gitlink, and the two are not the same set.
-      // `assertRestorable` reads the recording's; what `release` actually skips is every gitlink
-      // in the copy of the operator's own tree. A repository cloned into the workspace after the
-      // recording was made is in the second and not the first — so reporting only the first said
-      // nothing about it and then promised, unqualified, that the files come back.
-      const fresh = join(dir, 'vendored-since');
-      await mkdir(fresh, { recursive: true });
-      await initRepo(fresh);
-      await writeFile(join(fresh, 'mine.txt'), 'work only I have');
-      await run('git', ['add', '-A'], { cwd: fresh });
-      await run('git', ['commit', '-qm', 'since'], { cwd: fresh });
-
-      const { code, out } = await replay();
-      expect(code, out).toBe(0);
-      expect(out).toContain('vendored-since');
-      expect(out).toContain('restored when the replay ends, except inside');
-      expect(out).toContain('agenticreplay holds no copy of what is inside them');
-    },
-    timeout,
-  );
-
-  it(
-    'copies what it can into a --worktree replay instead of dying inside git',
-    async () => {
-      const { code, out } = await replay('--worktree');
-      expect(code, out).toBe(0);
-      // A different sentence from the in-place case, because a fresh directory is not a working
-      // tree the repository is already sitting in: there, it is simply not there.
-      expect(out).toContain('replay.nested_kept');
-      expect(out).toContain('absent from a fresh worktree');
-      expect(await safetyCopies()).toEqual([]);
-    },
-    timeout,
-  );
-});
-
-/**
- * `agenticreplay replay --from` — and so `agenticreplay compare`, which forks — restores a checkpoint into a
- * directory it makes itself, and used to die inside git while doing it.
- *
- * Nothing in that path deletes anything, so the tolerance is unconditional; what it owes the
- * operator is a word about the one thing the fresh worktree will not contain. The failure it
- * replaces named a tree hash and an internal parameter and no course of action.
- */
-describe('a fork taken in a workspace holding a nested git repository', () => {
-  const timeout = 120_000;
-  let dir: string;
-  let model: Awaited<ReturnType<typeof startFakeModel>>;
-  let log: LogEntry[];
-  let out: Output;
-
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-nested-fork-'));
-    model = await startFakeModel();
-    log = [];
-    out = new Output({ write: () => {}, isTTY: false, sink: (entry) => log.push(entry) });
-    await initRepo(dir);
-    await nestRepo(dir, 'tools/vendored');
-    await writeFile(join(dir, 'auth.ts'), 'export const fixed = false;\n');
-    process.env.FAKE_AGENT_TURNS = '3';
-    process.env.FAKE_AGENT_CWD = dir;
-  });
-
-  afterEach(async () => {
-    await model.close();
-    delete process.env.FAKE_AGENT_TURNS;
-    delete process.env.FAKE_AGENT_CWD;
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  it(
-    'restores what the checkpoint holds, and says what a fresh worktree will not have',
-    async () => {
-      const parent = await recordCommand(
-        parseArgs([
-          'record',
-          'generic-openai',
-          '--upstream-anthropic',
-          model.url,
-          '--',
-          'node',
-          FAKE_AGENT,
-        ]),
-        out,
-        dir,
-      );
-      const events = await (await TraceReader.open(parent.runDir)).events();
-      const from = deriveCheckpoints(events)[0]!.seq;
-      log.length = 0;
-
-      await replayCommand(
-        parseArgs([
-          'replay',
-          parent.runId,
-          '--from',
-          String(from),
-          '--upstream-anthropic',
-          model.url,
-        ]),
-        out,
-        dir,
-      );
-
-      const kept = log.find((entry) => entry.event === 'replay.nested_kept');
-      expect(kept?.fields.paths).toBe('tools/vendored');
-      expect(String(kept?.fields.effect)).toContain('absent from a fresh worktree');
-    },
-    timeout,
-  );
-});
-
-/**
- * The half that still refuses, and the reason the guard runs before anything has been copied.
- *
- * `indexrag` declares `resetBeforeReplay: ['cache', 'vector_store']`, so the replay really does
- * `rm -rf cache` before restoring — and a nested repository inside it is one the restore cannot
- * refill. A recording made today cannot hold that gitlink, because the forced add drops it
- * (`ShadowIndex.dropForcedGitlinks`); the recordings that can are the ones already on disk, made
- * before it did, which is exactly who a guard is here for. So the tree is edited into the shape
- * one of those has, which is the only way to reach this from outside.
- */
-describe('a recording whose snapshot holds a nested repository inside a reset path', () => {
-  const timeout = 120_000;
-  let dir: string;
-  let scratch: string;
-  let env: NodeJS.ProcessEnv;
-  let runId: string;
-  let runDir: string;
-
-  /** Put a gitlink into the recorded tree, the way a pre-`dropForcedGitlinks` recording holds one. */
-  async function forgeGitlink(path: string): Promise<void> {
-    const store = join(runDir, 'fs');
-    const eventsPath = join(runDir, 'events.jsonl');
-    const lines = (await readFile(eventsPath, 'utf8')).split('\n');
-    const at = lines.findIndex((line) => line.includes('"fs.snapshot"'));
-    const event = JSON.parse(lines[at]!) as { attrs: { tree: string } };
-    const git = (...args: string[]) =>
-      run('git', ['--git-dir', store, ...args], {
-        env: { ...process.env, GIT_INDEX_FILE: join(runDir, 'forge.index') },
-      });
-    await git('read-tree', event.attrs.tree);
-    // Any commit id will do: a gitlink is a reference to a history this store never held, which
-    // is the entire reason a restore cannot write one out.
-    await git('update-index', '--add', '--cacheinfo', `160000,${'0'.repeat(39)}1,${path}`);
-    event.attrs.tree = (await git('write-tree')).stdout.trim();
-    lines[at] = JSON.stringify(event);
-    await writeFile(eventsPath, lines.join('\n'));
-  }
-
-  beforeEach(async () => {
-    scratch = await mkdtemp(join(tmpdir(), 'agenticreplay-doomed-tmp-'));
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-doomed-ws-'));
-    env = { ...process.env, NO_COLOR: '1', TMPDIR: scratch, TMP: scratch, TEMP: scratch };
-    await initRepo(dir);
-    await mkdir(join(dir, 'cache'), { recursive: true });
-    await writeFile(join(dir, 'cache', 'index.bin'), 'an index the pipeline built');
-    await nestRepo(dir, 'cache/corpus-repo');
-    await writeFile(join(dir, 'a.mjs'), QUIET_AGENT);
-    await run(process.execPath, [cli, 'record', 'indexrag', '--', 'node', 'a.mjs'], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    });
-    [runId] = (await readdir(join(dir, '.agenticreplay', 'runs'))) as [string];
-    runDir = join(dir, '.agenticreplay', 'runs', runId!);
-  }, timeout);
-
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-    await rm(scratch, { recursive: true, force: true });
-  });
-
-  it(
-    'refuses, deletes nothing, and has not copied anything to have to put back',
-    async () => {
-      await forgeGitlink('cache/corpus-repo');
-      const result = (await run(process.execPath, [cli, 'replay', runId!], {
-        cwd: dir,
-        env,
-        timeout: timeout / 2,
-      }).catch((error: unknown) => error)) as {
-        code?: number;
-        stdout?: string;
-        stderr?: string;
-      };
-      const out = `${result.stdout ?? ''}${result.stderr ?? ''}`;
-
-      expect(result.code ?? 0, out).not.toBe(0);
-      expect(out).toContain('cannot put cache/corpus-repo back');
-      // The guard runs before the safety copy, so there is no copy to announce and no scratch
-      // directory to leave behind. Announcing a restore for a replay that never started is how
-      // the operator came to be told their files had been moved somewhere they had not.
-      expect(out).not.toContain('replay.restored');
-      expect(await readdir(scratch)).toEqual([]);
-
-      expect(await readFile(join(dir, 'cache', 'index.bin'), 'utf8')).toBe(
-        'an index the pipeline built',
-      );
-      expect(await readFile(join(dir, 'cache', 'corpus-repo', 'inside.txt'), 'utf8')).toBe(
-        'held by the nested repo',
-      );
-    },
-    timeout,
-  );
-});
-
-/**
- * What the in-place path owes the operator, now that it no longer refuses.
- *
- * `agenticreplay replay` restores the recording's tree into the operator's own directory and runs the
- * recorded agent there, live — agenticreplay does not intercept tool execution, so a recorded build step,
- * generator or `rm` reaches inside a nested repository like any other path. The safety copy holds
- * that repository only as a gitlink, so nothing it does there is reversible.
- *
- * That hole cannot be closed by a snapshot: git stores a nested repository as a commit id and
- * never its contents. What can be closed is the operator being told the opposite — the note used
- * to say "they are left exactly as they are" and the line under it "your files are restored when
- * the replay ends", of the one region where neither was true.
- */
-describe('a recording whose agent writes inside the nested repository', () => {
-  const timeout = 120_000;
-  const nested = ['tools', 'nested-repo'];
-  let dir: string;
-  let scratch: string;
-  let env: NodeJS.ProcessEnv;
-  let runId: string;
-
-  /** The operator's own uncommitted work, inside a vendored checkout they are patching. */
-  async function operatorsWork(): Promise<void> {
-    await writeFile(join(dir, ...nested, 'vendored.txt'), 'my own uncommitted patch');
-    await writeFile(join(dir, ...nested, 'notes.txt'), 'notes only I have');
-  }
-
-  beforeEach(async () => {
-    scratch = await mkdtemp(join(tmpdir(), 'agenticreplay-inside-tmp-'));
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-inside-ws-'));
-    env = { ...process.env, NO_COLOR: '1', TMPDIR: scratch, TMP: scratch, TEMP: scratch };
-    await initRepo(dir);
-    await nestRepo(dir, nested.join('/'));
-    await writeFile(
-      join(dir, 'a.mjs'),
-      [
-        "import { writeFileSync, rmSync, mkdirSync, existsSync } from 'node:fs';",
-        "import { join } from 'node:path';",
-        "const inside = join(process.cwd(), 'tools', 'nested-repo');",
-        'if (!existsSync(inside)) mkdirSync(inside, { recursive: true });',
-        "writeFileSync(join(inside, 'vendored.txt'), 'written by the replayed agent');",
-        "rmSync(join(inside, 'notes.txt'), { force: true });",
-        "process.stdout.write('HI');",
-      ].join('\n'),
-    );
-    await run(process.execPath, [cli, 'record', 'node', '--', 'node', 'a.mjs'], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    });
-    [runId] = (await readdir(join(dir, '.agenticreplay', 'runs'))) as [string];
-    await operatorsWork();
-  }, timeout);
-
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-    await rm(scratch, { recursive: true, force: true });
-  });
-
-  it(
-    'says so before the agent runs, rather than promising a restore it cannot perform',
-    async () => {
-      const { stdout, stderr } = await run(process.execPath, [cli, 'replay', runId!], {
-        cwd: dir,
-        env,
-        timeout: timeout / 2,
-      });
-      const out = `${stdout}${stderr}`;
-      // Not "they are left exactly as they are", which was only ever true of the restore.
-      expect(out).toContain('agenticreplay holds no copy of what is inside them');
-      expect(out).toContain('--worktree');
-      // And the unqualified promise on the next line carries the same exception, since that is
-      // the sentence the operator actually acts on.
-      expect(out).toContain('restored when the replay ends, except inside tools/nested-repo');
-    },
-    timeout,
-  );
-
-  it(
-    'and --worktree, which it points at, really does keep the agent out',
-    async () => {
-      const { stdout, stderr } = await run(
-        process.execPath,
-        [cli, 'replay', runId!, '--worktree'],
-        { cwd: dir, env, timeout: timeout / 2 },
-      );
-      expect(`${stdout}${stderr}`).toContain('absent from a fresh worktree');
-      // The advice has to hold, or it is worse than none: the same recording, run this way,
-      // leaves the operator's copy alone entirely.
-      expect(await readFile(join(dir, ...nested, 'vendored.txt'), 'utf8')).toBe(
-        'my own uncommitted patch',
-      );
-      expect(await readFile(join(dir, ...nested, 'notes.txt'), 'utf8')).toBe('notes only I have');
-    },
-    timeout,
-  );
-});
-
-/**
- * THE SAME REPOSITORY, WITH NO COMMIT IN IT YET.
- *
- * Every block above is about a nested repository git can record as a gitlink. One that has never
- * been committed to has no HEAD for git to name it by, so `git add -A` refuses the whole add — and
- * agenticreplay had no answer for that at either end:
- *
- *   recorded with it there   every turn's snapshot threw, so the trace held no `fs.snapshot` at
- *                            all, and the replay read that absence as `--no-fs` and told the
- *                            operator the run had been "recorded with --no-fs" when nobody passed it
- *   appearing before it      the safety snapshot threw, so the replay exited 1 on git's own
- *                            sentence about a commit checked out, leaving behind the `agenticreplay-safety-*`
- *                            directory it had already made and printing no path to it
- *
- * `git init` in a subdirectory is all it takes, which is what starting a second project inside a
- * workspace looks like until the first commit. Both ends are driven through the built binary here,
- * because the thing that was wrong was what an operator saw and what was left on their disk.
- */
-describe('a nested git repository with no commit in it', () => {
-  const timeout = 120_000;
-  const nested = ['newproject'];
-  let dir: string;
-  let scratch: string;
-  let env: NodeJS.ProcessEnv;
-
-  /** `git init` and a file, and nothing committed — the state git cannot make a gitlink of. */
-  async function startProject(): Promise<void> {
-    const at = join(dir, ...nested);
-    await mkdir(at, { recursive: true });
-    await initRepo(at);
-    await writeFile(join(at, 'main.py'), 'work of my own, never committed anywhere');
-  }
-
-  async function record(): Promise<{ id: string; out: string }> {
-    const result = await run(process.execPath, [cli, 'record', 'node', '--', 'node', 'a.mjs'], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    });
-    const [id] = (await readdir(join(dir, '.agenticreplay', 'runs'))) as [string];
-    return { id, out: `${result.stdout}${result.stderr}` };
-  }
-
-  async function replay(id: string): Promise<{ code: number; out: string }> {
-    const result = (await run(process.execPath, [cli, 'replay', id], {
-      cwd: dir,
-      env,
-      timeout: timeout / 2,
-    }).catch((error: unknown) => error)) as { code?: number; stdout?: string; stderr?: string };
-    return { code: result.code ?? 0, out: `${result.stdout ?? ''}${result.stderr ?? ''}` };
-  }
-
-  beforeEach(async () => {
-    scratch = await mkdtemp(join(tmpdir(), 'agenticreplay-nc-tmp-'));
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-nc-ws-'));
-    env = { ...process.env, NO_COLOR: '1', TMPDIR: scratch, TMP: scratch, TEMP: scratch };
-    await initRepo(dir);
-    await writeFile(join(dir, 'README.md'), 'the outer project');
-    await writeFile(join(dir, 'a.mjs'), QUIET_AGENT);
-  }, timeout);
-
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-    await rm(scratch, { recursive: true, force: true });
-  });
-
-  it(
-    'is recorded around, not instead of: the run still has snapshots, and says what is missing',
-    async () => {
-      await startProject();
-      const { id, out } = await record();
-
-      expect(out).toContain('fs.nested_not_captured');
-      expect(out).toContain('newproject');
-      expect(out).not.toContain('fs.snapshot_failed');
-
-      // The trace has the workspace in it, which is the whole difference: with the add failing
-      // there was no `fs.snapshot` anywhere, and everything downstream read that as `--no-fs`.
-      const events = await new TraceReader(join(dir, '.agenticreplay', 'runs', id)).events();
-      const snapshots = events.filter((event) => event.type === 'fs.snapshot');
-      expect(snapshots.length).toBeGreaterThan(0);
-      expect(deriveCheckpoints(events).some((point) => point.fsTree !== undefined)).toBe(true);
-
-      const capture = await FsCapture.start({
-        runDir: join(dir, '.agenticreplay', 'runs', id),
-        cwd: dir,
-      });
-      const tree = String(snapshots[0]?.attrs?.['tree']);
-      const held = (await capture.files(tree)).map((file) => file.path);
-      expect(held).toContain('README.md');
-      // And it is left OUT rather than swept in: a repository agenticreplay cannot restore is one it must
-      // not pretend to hold either.
-      expect(held.filter((path) => path.startsWith('newproject/'))).toEqual([]);
-      expect(await capture.gitlinks(tree)).toEqual([]);
-    },
-    timeout,
-  );
-
-  it(
-    'replays with one appearing since, keeping the work in it and leaving no copy behind',
-    async () => {
-      const { id } = await record();
-      // Started after the recording — the shape that took the safety snapshot down with it.
-      await startProject();
-      const mine = join(dir, ...nested, 'main.py');
-
-      const { code, out } = await replay(id);
-
-      expect(code, out).toBe(0);
-      expect(out).not.toContain('does not have a commit checked out');
-      // Named before the agent runs, for the reason every other nested repository is: agenticreplay holds
-      // no copy of what is in there, so whatever the replay does there stays.
-      expect(out).toContain('replay.nested_kept');
-      expect(out).toContain('newproject');
-      expect(await readFile(mine, 'utf8')).toBe('work of my own, never committed anywhere');
-      expect(
-        (await readdir(scratch)).filter((entry) => entry.startsWith('agenticreplay-safety-')),
-      ).toEqual([]);
-    },
-    timeout,
-  );
-});