claude-code-session-manager 0.98.0 → 0.101.0

package/src/main/__tests__/epicValidationHook.test.cjs

@@ -1,291 +0,0 @@
-/**
- * epicValidationHook.test.cjs — PRD 986: a PRD check-in triggers validation
- * in the authoring Epic; it never asserts the PRD is done.
- *
- * Covers the PRD's five required cases:
- *   (a) a completed check-in enqueues exactly one validation prompt naming
- *       the PRD slug;
- *   (b) a check-in for a non-active Epic enqueues nothing;
- *   (c) a second check-in for the same (epicId, prdSlug) enqueues nothing;
- *   (d) the enqueued prompt contains the PRD's absolute path and the
- *       VERIFIED/REFUTED instruction (plus the not-evidence warning and the
- *       git diff --stat / empty-diff-is-REFUTED rule);
- *   (e) LOOP GUARD — an appended event that is a validation result never
- *       enqueues a further prompt.
- * Plus: the SM_EPIC_VALIDATION_DISABLE kill-switch, the born-'unvalidated'
- * stamp, and end-to-end wiring through notifyOriginatingTab.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/epicValidationHook.test.cjs
- */
-
-'use strict';
-
-import { test, expect, vi, beforeEach, afterEach } from 'vitest';
-const {
-  maybeEnqueueValidationPrompt,
-  buildValidationPrompt,
-  __resetForTests,
-} = require('../lib/epicValidationHook.cjs');
-const { notifyOriginatingTab } = require('../scheduler.cjs');
-
-const EPIC = 'epic-986';
-const SLUG = '986-example-prd';
-const PRD_PATH = '/abs/path/to/session-manager-operations/scheduler/epics/epic-986/prds-archived/986-example-prd.md';
-
-/** An active-index snapshot AS IT LOOKS RIGHT AFTER the scheduler's check-in
- *  append: exactly one validation-stamped response event for this prdSlug. */
-function indexAfterCheckin({ status = 'active', extraEvents = [] } = {}) {
-  return {
-    sessions: { [EPIC]: { id: EPIC, status } },
-    events: {
-      [EPIC]: [
-        { id: 'e1', promptSessionId: EPIC, kind: 'prompt', causedByEventId: null, at: '2026-08-02T00:00:00Z', text: 'goal' },
-        {
-          id: 'e2', promptSessionId: EPIC, kind: 'response', causedByEventId: 'e1',
-          at: '2026-08-02T01:00:00Z', text: `PRD ${SLUG} finished: completed.`,
-          prdSlug: SLUG, outcome: 'completed', validation: 'unvalidated',
-        },
-        ...extraEvents,
-      ],
-    },
-  };
-}
-
-function callArgs(overrides = {}) {
-  return {
-    cwd: '/some/cwd',
-    epicId: EPIC,
-    prdSlug: SLUG,
-    prdPath: PRD_PATH,
-    outcome: 'completed',
-    eventValidation: 'unvalidated',
-    ...overrides,
-  };
-}
-
-beforeEach(() => {
-  __resetForTests();
-  delete process.env.SM_EPIC_VALIDATION_DISABLE;
-});
-
-afterEach(() => {
-  delete process.env.SM_EPIC_VALIDATION_DISABLE;
-});
-
-// ─── (a) completed check-in → exactly one prompt naming the slug ────────────
-
-test('(a) a completed check-in enqueues exactly one validation prompt naming the PRD slug', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  const res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(res.enqueued).toBe(true);
-  expect(sendPrompt).toHaveBeenCalledTimes(1);
-  expect(sendPrompt).toHaveBeenCalledWith(EPIC, expect.stringContaining(SLUG));
-});
-
-// ─── (b) non-active Epic → nothing ──────────────────────────────────────────
-
-test('(b) a check-in for a completed (non-active) Epic enqueues nothing', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin({ status: 'completed' }));
-
-  const res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(res).toEqual({ enqueued: false, reason: 'epic-not-active' });
-  expect(sendPrompt).not.toHaveBeenCalled();
-});
-
-test('(b) an unknown Epic (no active-index entry) enqueues nothing — join-only, never creates an Epic', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => ({ sessions: {}, events: {} }));
-
-  const res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(res).toEqual({ enqueued: false, reason: 'epic-not-active' });
-  expect(sendPrompt).not.toHaveBeenCalled();
-});
-
-// ─── (c) second check-in for the same (epicId, prdSlug) → nothing ───────────
-
-test('(c) a second check-in for the same (epicId, prdSlug) enqueues nothing (in-memory guard)', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  expect(maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex }).enqueued).toBe(true);
-  const second = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(second).toEqual({ enqueued: false, reason: 'already-fired' });
-  expect(sendPrompt).toHaveBeenCalledTimes(1);
-});
-
-test('(c) durable guard: two validation-stamped check-in events already on the chain skip even after a process restart emptied the in-memory set', () => {
-  const sendPrompt = vi.fn();
-  // Chain carries the current check-in PLUS an earlier one for the same slug
-  // (a re-notify after restart appends a second response event).
-  const readActiveIndex = vi.fn(() => indexAfterCheckin({
-    extraEvents: [{
-      id: 'e3', promptSessionId: EPIC, kind: 'response', causedByEventId: 'e2',
-      at: '2026-08-02T02:00:00Z', text: `PRD ${SLUG} finished: completed.`,
-      prdSlug: SLUG, outcome: 'completed', validation: 'unvalidated',
-    }],
-  }));
-
-  __resetForTests(); // simulate the restart: in-memory set is empty
-  const res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(res).toEqual({ enqueued: false, reason: 'already-fired-durable' });
-  expect(sendPrompt).not.toHaveBeenCalled();
-});
-
-test('(c) a different PRD slug for the same Epic still fires — the guard is per (epicId, prdSlug) pair, not per Epic', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  expect(maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex }).enqueued).toBe(true);
-  const other = maybeEnqueueValidationPrompt(
-    callArgs({ prdSlug: '987-other-prd', prdPath: '/abs/987-other-prd.md' }),
-    { sendPrompt, readActiveIndex: vi.fn(() => ({ sessions: { [EPIC]: { id: EPIC, status: 'active' } }, events: { [EPIC]: [{ id: 'x', kind: 'response', prdSlug: '987-other-prd', validation: 'unvalidated' }] } })) },
-  );
-
-  expect(other.enqueued).toBe(true);
-  expect(sendPrompt).toHaveBeenCalledTimes(2);
-});
-
-// ─── (d) prompt content ─────────────────────────────────────────────────────
-
-test('(d) the enqueued prompt contains the PRD absolute path, the unverified-claim label, and the VERIFIED/REFUTED instruction', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  const prompt = sendPrompt.mock.calls[0][1];
-  expect(prompt).toContain(PRD_PATH);
-  expect(prompt).toContain(SLUG);
-  expect(prompt).toContain('UNVERIFIED CLAIM');
-  expect(prompt).toContain('"completed"');
-  expect(prompt).toContain('VERIFIED or REFUTED');
-  expect(prompt).toMatch(/file:line|command output/);
-  // AC #3: the not-evidence warning + the git diff --stat / empty-diff rule.
-  expect(prompt).toContain('exit code of 0');
-  expect(prompt).toContain('NOT evidence');
-  expect(prompt).toContain('git diff --stat');
-  expect(prompt).toMatch(/empty diff.*REFUTED/i);
-  // Acceptance-criteria-against-working-tree instruction.
-  expect(prompt).toMatch(/Acceptance criteria/i);
-  expect(prompt).toMatch(/working tree/i);
-});
-
-test('(d) buildValidationPrompt degrades gracefully when the PRD path could not be resolved', () => {
-  const prompt = buildValidationPrompt({ prdSlug: SLUG, prdPath: null, outcome: 'failed' });
-  expect(prompt).toContain(SLUG);
-  expect(prompt).toContain('path could not be resolved');
-  expect(prompt).toContain('"failed"');
-});
-
-// ─── (e) LOOP GUARD ─────────────────────────────────────────────────────────
-
-test('(e) LOOP GUARD: an appended event that is a validation result never enqueues a further prompt', () => {
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  for (const eventValidation of ['verified', 'refuted', 'validating', undefined]) {
-    const res = maybeEnqueueValidationPrompt(callArgs({ eventValidation }), { sendPrompt, readActiveIndex });
-    expect(res).toEqual({ enqueued: false, reason: 'not-a-checkin' });
-  }
-  expect(sendPrompt).not.toHaveBeenCalled();
-});
-
-// ─── kill-switch ────────────────────────────────────────────────────────────
-
-test('SM_EPIC_VALIDATION_DISABLE=1 turns the hook off entirely', () => {
-  process.env.SM_EPIC_VALIDATION_DISABLE = '1';
-  const sendPrompt = vi.fn();
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-
-  const res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex });
-
-  expect(res).toEqual({ enqueued: false, reason: 'disabled' });
-  expect(sendPrompt).not.toHaveBeenCalled();
-  expect(readActiveIndex).not.toHaveBeenCalled();
-});
-
-// ─── never throws ───────────────────────────────────────────────────────────
-
-test('a sendPrompt that throws is swallowed and logged, never propagated (fire-and-forget contract)', () => {
-  const sendPrompt = vi.fn(() => { throw new Error('IPC gone'); });
-  const readActiveIndex = vi.fn(() => indexAfterCheckin());
-  const log = { error: vi.fn() };
-
-  let res;
-  expect(() => {
-    res = maybeEnqueueValidationPrompt(callArgs(), { sendPrompt, readActiveIndex, log });
-  }).not.toThrow();
-  expect(res).toEqual({ enqueued: false, reason: 'error' });
-  expect(log.error).toHaveBeenCalled();
-});
-
-// ─── wiring through notifyOriginatingTab ────────────────────────────────────
-
-test('notifyOriginatingTab: a routed check-in stamps validation:unvalidated and fires the validation hook once with the Epic id + slug', async () => {
-  const sendPrompt = vi.fn();
-  const appendResponseEvent = vi.fn(async () => true);
-  const enqueueValidation = vi.fn(() => ({ enqueued: true }));
-  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: EPIC, path: PRD_PATH }));
-  const loadSessions = vi.fn(async () => ({ tabs: [] }));
-
-  await notifyOriginatingTab(
-    { slug: SLUG, status: 'completed', cwd: '/some/cwd' },
-    { parsePrdRaw, loadSessions, sendPrompt, appendResponseEvent, enqueueValidation },
-  );
-
-  expect(appendResponseEvent).toHaveBeenCalledWith(
-    '/some/cwd', EPIC, expect.stringContaining(SLUG),
-    expect.objectContaining({ prdSlug: SLUG, outcome: 'completed', validation: 'unvalidated' }),
-  );
-  expect(enqueueValidation).toHaveBeenCalledTimes(1);
-  expect(enqueueValidation).toHaveBeenCalledWith(
-    expect.objectContaining({
-      cwd: '/some/cwd',
-      epicId: EPIC,
-      prdSlug: SLUG,
-      outcome: 'completed',
-      eventValidation: 'unvalidated',
-    }),
-    expect.objectContaining({ sendPrompt }),
-  );
-  // The check-in routed into the Epic chain — no tab-prompt fallback fires.
-  expect(sendPrompt).not.toHaveBeenCalled();
-});
-
-test('notifyOriginatingTab: a REFUSED append (unknown/completed Epic) never fires the validation hook', async () => {
-  const sendPrompt = vi.fn();
-  const appendResponseEvent = vi.fn(async () => false);
-  const enqueueValidation = vi.fn();
-  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: EPIC, sourceTabId: 'tab-x' }));
-  const loadSessions = vi.fn(async () => ({ tabs: [] }));
-
-  await notifyOriginatingTab(
-    { slug: SLUG, status: 'completed', cwd: '/some/cwd' },
-    { parsePrdRaw, loadSessions, sendPrompt, appendResponseEvent, enqueueValidation },
-  );
-
-  expect(enqueueValidation).not.toHaveBeenCalled();
-});
-
-test('notifyOriginatingTab: a validation hook that throws never blocks the notification path', async () => {
-  const sendPrompt = vi.fn();
-  const appendResponseEvent = vi.fn(async () => true);
-  const enqueueValidation = vi.fn(() => { throw new Error('boom'); });
-  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: EPIC, path: PRD_PATH }));
-  const loadSessions = vi.fn(async () => ({ tabs: [] }));
-
-  await expect(
-    notifyOriginatingTab(
-      { slug: SLUG, status: 'failed', cwd: '/some/cwd' },
-      { parsePrdRaw, loadSessions, sendPrompt, appendResponseEvent, enqueueValidation },
-    ),
-  ).resolves.not.toThrow();
-});

package/src/main/__tests__/exchanges.test.cjs

@@ -1,122 +0,0 @@
-'use strict';
-
-/**
- * Unit test for exchanges.cjs.
- *
- * PRD 1391: exchanges now write to <cwd>/session-manager-operations/
- * prompt-sessions/exchanges.jsonl instead of the old global
- * ~/.claude/knowledge-log/exchanges/<encodeCwd(cwd)>.jsonl store — each test
- * uses a fresh tmp directory as its project `cwd` so no real project state is
- * touched.
- *
- * Stubs summarize.cjs to avoid any network calls.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/exchanges.test.cjs
- */
-
-import { test, describe, beforeEach } from 'vitest';
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const fsp = require('node:fs/promises');
-const path = require('node:path');
-const os = require('node:os');
-
-function mkTmpProject() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'exchanges-test-'));
-}
-
-function exchangesLogPath(cwd) {
-  return path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'exchanges.jsonl');
-}
-
-function stubSummarize(fn) {
-  const summarizePath = require.resolve('../lib/summarize.cjs');
-  delete require.cache[summarizePath];
-  require.cache[summarizePath] = {
-    id: summarizePath,
-    filename: summarizePath,
-    loaded: true,
-    exports: { summarize: fn },
-  };
-}
-
-beforeEach(() => {
-  delete require.cache[require.resolve('../exchanges.cjs')];
-});
-
-describe('recordExchange', () => {
-  test('writes a complete record when summarize succeeds', async () => {
-    stubSummarize(async () => ({ summary: 'Test summary.', model: 'claude-haiku-4-5' }));
-
-    const { recordExchange } = require('../exchanges.cjs');
-
-    const cwd = mkTmpProject();
-    const sessionId = 'sess-abc-123';
-    const prompt = 'What is 2+2?';
-    const result = 'The answer is 4.';
-
-    await recordExchange({ sessionId, cwd, prompt, result });
-
-    const content = await fsp.readFile(exchangesLogPath(cwd), 'utf8');
-    const lines = content.trim().split('\n').filter(Boolean);
-    assert.equal(lines.length, 1, 'should write exactly one line');
-
-    const record = JSON.parse(lines[0]);
-    assert.equal(record.sessionId, sessionId);
-    assert.equal(record.cwd, cwd);
-    assert.equal(record.prompt, prompt);
-    assert.equal(record.result, result);
-    assert.equal(record.summary, 'Test summary.');
-    assert.equal(record.model, 'claude-haiku-4-5');
-    assert.ok(record.ts, 'ts field should be present');
-    assert.equal(record.degraded, undefined, 'should not have degraded field on success');
-  });
-
-  test('still writes a record when summarize degrades (no_api_key)', async () => {
-    stubSummarize(async (text) => ({
-      summary: text.slice(0, 600),
-      model: 'raw',
-      degraded: 'no_api_key',
-    }));
-
-    const { recordExchange } = require('../exchanges.cjs');
-
-    const cwd = mkTmpProject();
-    const sessionId = 'sess-degrade-456';
-    const result = 'Some verbatim result text from the assistant.';
-
-    await recordExchange({ sessionId, cwd, prompt: 'do something', result });
-
-    const content = await fsp.readFile(exchangesLogPath(cwd), 'utf8');
-    const lines = content.trim().split('\n').filter(Boolean);
-    assert.equal(lines.length, 1);
-
-    const record = JSON.parse(lines[0]);
-    assert.equal(record.sessionId, sessionId);
-    assert.equal(record.result, result, 'verbatim result must be stored');
-    assert.equal(record.degraded, 'no_api_key');
-    assert.equal(record.model, 'raw');
-    // summary is the raw slice of the result
-    assert.equal(record.summary, result.slice(0, 600));
-  });
-
-  test('appends multiple records to the same file', async () => {
-    stubSummarize(async () => ({ summary: 'ok', model: 'claude-haiku-4-5' }));
-
-    const { recordExchange } = require('../exchanges.cjs');
-
-    const cwd = mkTmpProject();
-
-    await recordExchange({ sessionId: 's1', cwd, prompt: 'first', result: 'res1' });
-    await recordExchange({ sessionId: 's2', cwd, prompt: 'second', result: 'res2' });
-
-    const content = await fsp.readFile(exchangesLogPath(cwd), 'utf8');
-    const lines = content.trim().split('\n').filter(Boolean);
-    assert.equal(lines.length, 2);
-
-    const r1 = JSON.parse(lines[0]);
-    const r2 = JSON.parse(lines[1]);
-    assert.equal(r1.sessionId, 's1');
-    assert.equal(r2.sessionId, 's2');
-  });
-});

package/src/main/__tests__/exchangesPromptId.test.cjs

@@ -1,61 +0,0 @@
-/**
- * exchangesPromptId.test.cjs — recordExchange() round-trips the optional
- * promptId field (PRD 749). Separate file from exchanges.test.cjs (which
- * runs under node:test, not vitest) so this is picked up by
- * `npx vitest run` per this repo's test:unit convention.
- *
- * PRD 1391: exchanges now write to <cwd>/session-manager-operations/
- * prompt-sessions/exchanges.jsonl — each test uses a fresh tmp directory as
- * its project `cwd`.
- *
- * Run: timeout 120 npx vitest run src/main/__tests__/exchangesPromptId.test.cjs
- */
-
-'use strict';
-
-import { test, expect, beforeEach } from 'vitest';
-const fs = require('node:fs');
-const fsp = require('node:fs/promises');
-const path = require('node:path');
-const os = require('node:os');
-
-function mkTmpProject() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'exchanges-promptid-test-'));
-}
-
-function exchangesLogPath(cwd) {
-  return path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'exchanges.jsonl');
-}
-
-beforeEach(() => {
-  // Stub summarize.cjs to avoid any network calls.
-  const summarizePath = require.resolve('../lib/summarize.cjs');
-  delete require.cache[summarizePath];
-  require.cache[summarizePath] = {
-    id: summarizePath,
-    filename: summarizePath,
-    loaded: true,
-    exports: { summarize: async () => ({ summary: 'ok', model: 'claude-haiku-4-5' }) },
-  };
-  delete require.cache[require.resolve('../exchanges.cjs')];
-});
-
-test('recordExchange persists promptId when supplied', async () => {
-  const { recordExchange } = require('../exchanges.cjs');
-
-  const cwd = mkTmpProject();
-  await recordExchange({ sessionId: 's1', cwd, prompt: 'do X', result: 'done', promptId: 'ticket-abc-123' });
-
-  const record = JSON.parse((await fsp.readFile(exchangesLogPath(cwd), 'utf8')).trim());
-  expect(record.promptId).toBe('ticket-abc-123');
-});
-
-test('recordExchange omits promptId when not supplied (no backfill/synthesis)', async () => {
-  const { recordExchange } = require('../exchanges.cjs');
-
-  const cwd = mkTmpProject();
-  await recordExchange({ sessionId: 's2', cwd, prompt: 'do Y', result: 'done' });
-
-  const record = JSON.parse((await fsp.readFile(exchangesLogPath(cwd), 'utf8')).trim());
-  expect('promptId' in record).toBe(false);
-});

package/src/main/__tests__/extractJson.test.cjs

@@ -1,51 +0,0 @@
-/**
- * extractJson.test.cjs — unit tests for lib/extractJson.cjs, the shared
- * brace-matching JSON extractor used by memoryAggregate.cjs and
- * chatRunner.cjs's parseStopSignal.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/extractJson.test.cjs
- */
-
-'use strict';
-
-import { test } from 'vitest';
-const assert = require('node:assert/strict');
-const { extractJson } = require('../lib/extractJson.cjs');
-
-test('plain JSON object → parsed object', () => {
-  assert.deepEqual(extractJson('{"a":1}'), { a: 1 });
-});
-
-test('JSON preceded by prose → parsed object', () => {
-  assert.deepEqual(extractJson('Here you go:\n{"a":1}'), { a: 1 });
-});
-
-test('JSON followed by trailing prose → parsed object', () => {
-  assert.deepEqual(extractJson('{"a":1}\nthanks!'), { a: 1 });
-});
-
-test('JSON wrapped in a code fence → parsed object', () => {
-  assert.deepEqual(extractJson('```json\n{"a":1}\n```'), { a: 1 });
-});
-
-test('nested braces and braces inside strings are handled', () => {
-  assert.deepEqual(extractJson('{"a":{"b":2},"c":"a } b"}'), { a: { b: 2 }, c: 'a } b' });
-});
-
-test('escaped quotes inside strings do not break brace matching', () => {
-  assert.deepEqual(extractJson('{"a":"a \\" } b"}'), { a: 'a " } b' });
-});
-
-test('no opening brace → null', () => {
-  assert.equal(extractJson('no json here'), null);
-});
-
-test('malformed JSON → null', () => {
-  assert.equal(extractJson('{a: 1 unterminated'), null);
-});
-
-test('empty/nullish input → null', () => {
-  assert.equal(extractJson(''), null);
-  assert.equal(extractJson(null), null);
-  assert.equal(extractJson(undefined), null);
-});

package/src/main/__tests__/files-reject-credentials.test.cjs

@@ -1,40 +0,0 @@
-'use strict';
-
-// rejectCredentials — write-side denylist for files:* mutations (write/create/
-// rename/delete all call it). Pure path logic; no fs touched.
-
-import { test } from 'vitest';
-const assert = require('node:assert/strict');
-const os = require('node:os');
-const path = require('node:path');
-
-const { rejectCredentials } = require('../files.cjs');
-
-const home = os.homedir();
-const under = (...p) => path.join(home, ...p);
-
-test('denies writing the OAuth credentials file', () => {
-  assert.throws(() => rejectCredentials(under('.claude', '.credentials.json')), /credentials\.json denied/);
-});
-
-test('denies writes anywhere inside ~/.ssh (keys, authorized_keys, config)', () => {
-  for (const p of ['authorized_keys', 'authorized_keys2', 'id_ed25519', 'config']) {
-    assert.throws(() => rejectCredentials(under('.ssh', p)), /\.ssh denied/, `~/.ssh/${p} should be denied`);
-  }
-  assert.throws(() => rejectCredentials(under('.ssh')), /\.ssh denied/);
-});
-
-test('denies writing autostart persistence entries', () => {
-  assert.throws(() => rejectCredentials(under('.config', 'autostart', 'evil.desktop')), /autostart denied/);
-});
-
-test('allows ordinary files — including shell rc, which developers do edit', () => {
-  for (const p of [under('Projects', 'app', 'src', 'index.ts'), under('.bashrc'), under('.zshrc'), under('.claude', 'session-manager', 'voice.json')]) {
-    assert.doesNotThrow(() => rejectCredentials(p), `${p} should be allowed`);
-  }
-});
-
-test('a path that merely starts with ".ssh" but is a sibling is not over-blocked', () => {
-  // ~/.sshfoo is a different entry — must NOT be caught by the ~/.ssh rule.
-  assert.doesNotThrow(() => rejectCredentials(under('.sshfoo', 'x')));
-});