create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/workflow-role-profile.test.mjs

@@ -0,0 +1,234 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { SessionRegistry } from '../session-registry.mjs';
+import {
+  createRoleProfile,
+  readRoleProfile,
+  listRoleProfiles,
+  roleProfileRefFor,
+  profileSessionFields,
+} from '../workflow-node-types/role-profile-store.mjs';
+import { buildAgentContext, findAgentGraphNode } from '../workflow-agent-context.mjs';
+import { loadWorkflowGraphMap, writeWorkflowGraphMap } from '../a2a-store.mjs';
+import { createNode } from '../workflow-node-runtime.mjs';
+
+const STATE_JSON_PROHIBITION = 'Never edit `Harness/a2a/**/state.json` directly — use typed actions.';
+
+function makeProject() {
+  const root = makeHarnessTempRoot('wf-role-profile-');
+  fs.mkdirSync(path.join(root, 'Harness', 'a2a', 'skills'), { recursive: true });
+  return root;
+}
+
+function seedAgentGraph(root, { nodeId, role = 'implementer' } = {}) {
+  const registry = new SessionRegistry();
+  const session = registry.create({
+    runtime: 'claude',
+    agentKind: 'subagent',
+    role,
+    graphNodeId: nodeId,
+  });
+  registry.update(session.sessionId, { status: 'running' });
+  writeWorkflowGraphMap(root, {
+    schemaVersion: 1,
+    version: 1,
+    nodes: [{
+      nodeId,
+      sessionId: session.sessionId,
+      kind: 'terminal-session',
+      agentKind: 'subagent',
+      runtime: 'claude',
+      role,
+      label: role,
+      status: 'running',
+    }],
+    edges: [],
+    positions: {},
+  });
+  return { registry, session, nodeId };
+}
+
+// AC-001: create-agent writes role profile (ROLE-1). createRoleProfile writes
+// the markdown profile file and returns the roleProfileRef; the session record
+// carries displayName / roleTitle / responsibility / capabilities /
+// roleProfileRef.
+test('AC-001 createRoleProfile writes the .md profile and session record carries role identity', async () => {
+  const root = makeProject();
+  try {
+    const nodeId = 'agent-role-1';
+    const result = createRoleProfile({
+      nodeId,
+      roleTitle: 'implementer',
+      displayName: 'Frontend Expert',
+      responsibility: 'Implement UI changes inside the assigned write set; run typecheck and build; return evidence.',
+      runtime: 'claude',
+      provider: 'anthropic',
+      model: 'claude-sonnet-4-5',
+      capabilities: ['ui-control-plane', 'typescript', 'playwright'],
+    }, root);
+
+    assert.equal(result.roleProfileRef, roleProfileRefFor(nodeId), 'roleProfileRef must point at the markdown profile');
+    assert.equal(result.profile.nodeId, nodeId);
+    assert.equal(result.profile.roleTitle, 'implementer');
+    assert.equal(result.profile.displayName, 'Frontend Expert');
+    assert.equal(result.profile.roleProfileRef, result.roleProfileRef);
+    assert.ok(Array.isArray(result.profile.capabilities), 'capabilities must be an array');
+
+    const mdPath = path.join(root, 'Harness', 'a2a', 'agent-roles', `${nodeId}.md`);
+    assert.ok(fs.existsSync(mdPath), '.md profile file must exist');
+    const md = fs.readFileSync(mdPath, 'utf8');
+    assert.ok(md.includes('# Role Profile'), '.md must be a markdown role profile');
+    assert.ok(md.includes('Frontend Expert'), '.md must carry displayName');
+    assert.ok(md.includes('implementer'), '.md must carry roleTitle');
+    assert.ok(md.includes('Implement UI changes'), '.md must carry responsibility prose');
+
+    const readBack = readRoleProfile(nodeId, root);
+    assert.deepEqual(readBack, result.profile, 'readRoleProfile must return the stored profile');
+
+    const listed = listRoleProfiles(root);
+    assert.ok(listed.some(profile => profile.nodeId === nodeId), 'listRoleProfiles must include the profile');
+
+    // Session record carries the role identity fields (create defaults first).
+    const registry = new SessionRegistry();
+    const session = registry.create({
+      runtime: 'claude',
+      agentKind: 'subagent',
+      role: 'terminal-agent',
+    });
+    assert.equal(session.roleProfileRef, null, 'roleProfileRef must be null until a profile is written');
+    assert.equal(session.responsibility, '', 'responsibility must default to empty');
+    assert.equal(session.roleTitle, 'terminal-agent', 'legacy default roleTitle must remain terminal-agent');
+
+    // Profile fields land on the session record through profileSessionFields.
+    registry.update(session.sessionId, profileSessionFields(result.profile));
+    const updated = registry.get(session.sessionId);
+    assert.equal(updated.displayName, 'Frontend Expert');
+    assert.equal(updated.roleTitle, 'implementer');
+    assert.equal(updated.responsibility, result.profile.responsibility);
+    assert.deepEqual(updated.capabilities, ['ui-control-plane', 'typescript', 'playwright']);
+    assert.equal(updated.roleProfileRef, result.roleProfileRef);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// AC-002: agent init/context prompt strongly injects its own role profile
+// (ROLE-2). buildAgentContext exposes the agent's own displayName, roleTitle,
+// responsibility, capabilities and roleProfileRef path before any task text.
+test('AC-002 agent context exposes its own role profile and roleProfileRef', async () => {
+  const root = makeProject();
+  try {
+    const { nodeId } = seedAgentGraph(root, { nodeId: 'agent-role-2' });
+    createRoleProfile({
+      nodeId,
+      roleTitle: 'reviewer',
+      displayName: 'Code Reviewer',
+      responsibility: 'Review the implementation and return evidence.',
+      runtime: 'claude',
+      provider: 'anthropic',
+      capabilities: ['code-review'],
+    }, root);
+
+    const graph = loadWorkflowGraphMap(root);
+    const graphNode = findAgentGraphNode(graph, nodeId);
+    assert.ok(graphNode, 'agent node must be present in the workflow graph');
+
+    const context = buildAgentContext(root, graphNode, graph).context;
+    assert.equal(context.roleProfile.nodeId, nodeId);
+    assert.equal(context.roleProfile.displayName, 'Code Reviewer');
+    assert.equal(context.roleProfile.roleTitle, 'reviewer');
+    assert.equal(context.roleProfile.responsibility, 'Review the implementation and return evidence.');
+    assert.deepEqual(context.roleProfile.capabilities, ['code-review']);
+    assert.equal(context.roleProfile.roleProfileRef, `Harness/a2a/agent-roles/${nodeId}.md`);
+    assert.equal(context.identity.displayName, 'Code Reviewer');
+    assert.equal(context.identity.roleTitle, 'reviewer');
+    assert.equal(context.identity.responsibility, 'Review the implementation and return evidence.');
+    assert.equal(context.identity.roleProfileRef, `Harness/a2a/agent-roles/${nodeId}.md`);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// AC-021 (MANUAL-2): when an agent node is connected to a node, the connected
+// node's manual is injected into the agent's context. AC-022 (MANUAL-3): the
+// injected manual text carries the state.json prohibition verbatim.
+test('AC-021/AC-022 connected node manual is injected into context with the state.json prohibition', async () => {
+  const root = makeProject();
+  try {
+    const { nodeId } = seedAgentGraph(root, { nodeId: 'agent-role-3' });
+    const markdown = await createNode(root, {
+      type: 'markdown',
+      title: 'Shared Notes',
+      markdown: '# Notes',
+    });
+    const graphMap = loadWorkflowGraphMap(root);
+    writeWorkflowGraphMap(root, {
+      ...graphMap,
+      edges: [
+        { id: 'edge-role-md', from: nodeId, to: markdown.node.nodeId, relation: 'default-output', direction: 'bidirectional', sourceHandle: 'output', targetHandle: 'markdown' },
+      ],
+    });
+    fs.writeFileSync(path.join(root, 'Harness', 'a2a', 'skills', 'workflow-markdown-node.json'), JSON.stringify({
+      schemaVersion: 1,
+      skillId: 'workflow-markdown-node',
+      nodeType: 'markdown',
+      description: 'Markdown node guide: shared durable notes between team agents.',
+      commands: [
+        {
+          name: 'markdown-append',
+          command: 'workflow-node-action --node <markdownNodeId> --action markdown.append --payload \'{"markdown":"..."}\'',
+          description: 'Append text to the connected markdown node through typed actions.',
+        },
+      ],
+      policy: { denied: ['direct-json-state-mutation'] },
+      prohibitions: [STATE_JSON_PROHIBITION],
+    }, null, 2));
+
+    const graph = loadWorkflowGraphMap(root);
+    const graphNode = findAgentGraphNode(graph, nodeId);
+    const context = buildAgentContext(root, graphNode, graph).context;
+
+    assert.ok(Array.isArray(context.connectedNodeManuals), 'connectedNodeManuals must be an array');
+    const manual = context.connectedNodeManuals.find(item => item.nodeType === 'markdown');
+    assert.ok(manual, 'connected markdown manual must be injected');
+    assert.equal(manual.nodeId, markdown.node.nodeId);
+    assert.equal(manual.skillId, 'workflow-markdown-node');
+    assert.ok(manual.text.includes('Markdown node guide'), 'manual description must be injected');
+    assert.ok(manual.text.includes('markdown.append'), 'manual commands must be injected');
+    assert.ok(manual.text.includes(STATE_JSON_PROHIBITION), 'manual must carry the state.json prohibition verbatim (AC-022)');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// AC-024 (partial) + T13/AC-008: the agent context carries the team-organization
+// decision flow (steps 1-10) including the ask-user gate for ambiguous targets.
+test('AC-024/T13 agent context carries team-organization guidance with the ask-user gate', async () => {
+  const root = makeProject();
+  try {
+    const { nodeId } = seedAgentGraph(root, { nodeId: 'agent-role-4' });
+    const graph = loadWorkflowGraphMap(root);
+    const graphNode = findAgentGraphNode(graph, nodeId);
+    const context = buildAgentContext(root, graphNode, graph).context;
+
+    const guidance = context.teamGuidance;
+    assert.ok(typeof guidance === 'string' && guidance.length > 0, 'teamGuidance must be a non-empty text block');
+    // §2 step 1: understand the task.
+    assert.ok(/understand the task/i.test(guidance), 'guidance must open with understanding the task');
+    // §2 step 2: decide whether team collaboration is needed.
+    assert.ok(/team collaboration is needed/i.test(guidance), 'guidance must include the team-needed decision (T1)');
+    // §2 step 3: choose roles from the roleTitle vocabulary.
+    assert.ok(/implementer/.test(guidance), 'guidance must name roles from the canonical vocabulary');
+    // §2 step 7 / §4.4 (T13): ambiguous target -> ask the user, never blind create/connect.
+    assert.ok(/ask the user/i.test(guidance), 'guidance must surface the ask-user gate for ambiguous targets (T13/AC-008)');
+    assert.ok(/never blindly create or connect/i.test(guidance), 'guidance must forbid blind create/connect on ambiguity');
+    // §2 steps 8-10: share context via Markdown, structured requests, Goal completion.
+    assert.ok(/Markdown/i.test(guidance), 'guidance must mention Markdown node sharing');
+    assert.ok(/Goal/i.test(guidance), 'guidance must mention Goal completion');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/src/wf-ui-server/__tests__/workflow-set-model.test.mjs

@@ -0,0 +1,261 @@
+// workflow-set-model.test.mjs
+//
+// agent.setModel backend action — model selection via project-scope runtime
+// config files (no TUI keystrokes needed).
+//
+//   M1: setModel on a codex session → 200, project .codex/config.toml model
+//       line updated, other lines preserved byte-for-byte, session record
+//       model updated + restartRequired true
+//   M2: unknown node → 404
+//   M3: runtime without project config (deepseek: user-scope only) → 409
+//       NO_PROJECT_MODEL_CONFIG
+//   M4: empty model → 400
+//   M5: only user-scope config exists (~/.codex) → 409
+//       NO_PROJECT_MODEL_CONFIG, user file untouched
+//   M6: JSON project config (.claude/settings.json) model field updated,
+//       other fields preserved
+//
+// Pattern: in-process node:test + HTTP server on port 0, one temp project
+// root for the server; config files and graph nodes are seeded under that
+// same root (the action resolves project config paths against the server's
+// project root). The user home is redirected to a temp dir BEFORE server.mjs
+// is imported — runtime-detector.mjs captures os.homedir() at module load —
+// so user-scope config paths (~/.codex/...) resolve inside the temp root and
+// the real user home is never read or written. node --test runs each file in
+// its own process, so the override stays local.
+//
+// Run: node --test src/wf-ui-server/__tests__/workflow-set-model.test.mjs
+import { after, before, describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { SessionRegistry } from '../session-registry.mjs';
+
+// ── fake home redirect (must precede the server.mjs import) ──
+const fakeHomeDir = makeHarnessTempRoot('wf-ui-set-model-home-');
+process.env.USERPROFILE = fakeHomeDir;
+process.env.HOMEDRIVE = path.parse(fakeHomeDir).root;
+process.env.HOMEPATH = fakeHomeDir.slice(path.parse(fakeHomeDir).root.length);
+process.env.HOME = fakeHomeDir;
+
+const { createServer } = await import('../server.mjs');
+
+// ── project seeding + helpers ──
+function tempProjectRoot(prefix) {
+  const root = makeHarnessTempRoot(prefix);
+  const a2a = path.join(root, 'Harness', 'a2a');
+  fs.mkdirSync(path.join(a2a, 'component-nodes'), { recursive: true });
+  fs.writeFileSync(path.join(a2a, 'component-nodes', 'index.json'), JSON.stringify({ schemaVersion: 1, nodes: [] }));
+  fs.writeFileSync(path.join(a2a, 'workflow-map.json'), JSON.stringify({
+    schemaVersion: 1,
+    version: 1,
+    nodes: [],
+    edges: [],
+    positions: {},
+    undoStack: [],
+    redoStack: [],
+    deletedNodes: [],
+  }));
+  return root;
+}
+
+function addGraphNode(root, { nodeId, sessionId, runtime }) {
+  const file = path.join(root, 'Harness', 'a2a', 'workflow-map.json');
+  const graph = JSON.parse(fs.readFileSync(file, 'utf8'));
+  graph.nodes.push({
+    nodeId,
+    sessionId,
+    kind: 'terminal-session',
+    agentKind: 'main',
+    runtime,
+    status: 'running',
+    cwd: root,
+    position: { x: 120, y: 90 },
+  });
+  graph.positions[nodeId] = { x: 120, y: 90 };
+  fs.writeFileSync(file, `${JSON.stringify(graph, null, 2)}\n`, 'utf8');
+}
+
+function makeAgentNode(registry, root, { runtime, graphNodeId }) {
+  const session = registry.create({
+    runtime,
+    agentKind: 'main',
+    role: 'main',
+    objective: 'agent.setModel test',
+    projectRoot: root,
+    cwd: root,
+    graphNodeId,
+  });
+  registry.update(session.sessionId, { status: 'running', graphNodeId });
+  addGraphNode(root, { nodeId: graphNodeId, sessionId: session.sessionId, runtime });
+  return { session: registry.get(session.sessionId), graphNodeId };
+}
+
+function jsonRequest(url, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method, headers: { 'content-type': 'application/json' } }, (res) => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(data) }); }
+        catch { resolve({ status: res.statusCode, body: data }); }
+      });
+    });
+    req.on('error', reject);
+    if (body !== undefined) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+describe('agent.setModel workflow node action', () => {
+  let root;
+  let registry;
+  let server;
+  let baseUrl;
+
+  before(async () => {
+    root = tempProjectRoot('wf-ui-set-model-');
+    registry = new SessionRegistry();
+    server = createServer({ projectRoot: root, sessionRegistry: registry, token: '' });
+    await new Promise(resolve => server.listen(0, resolve));
+    baseUrl = `http://127.0.0.1:${server.address().port}`;
+  });
+
+  after(() => {
+    if (server) server.close();
+    try { fs.rmSync(root, { recursive: true, force: true }); } catch {}
+    try { fs.rmSync(fakeHomeDir, { recursive: true, force: true }); } catch {}
+  });
+
+  it('M1: setModel updates the project .codex/config.toml model line and the session record', async () => {
+    const configDir = path.join(root, '.codex');
+    fs.mkdirSync(configDir, { recursive: true });
+    try {
+      const seed = [
+        '# codex project config',
+        'model = "gpt-5.4"',
+        'model_provider = "openai"',
+        '',
+        '[model_providers.anthropic]',
+        'name = "anthropic"',
+      ].join('\n');
+      fs.writeFileSync(path.join(configDir, 'config.toml'), seed, 'utf8');
+
+      const { session, graphNodeId } = makeAgentNode(registry, root, { runtime: 'codex', graphNodeId: 'setmodel-m1' });
+      const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.setModel`, {
+        method: 'POST',
+        body: { model: 'gpt-5.5' },
+      });
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      assert.equal(res.body.ok, true);
+      assert.equal(res.body.action, 'agent.setModel');
+      assert.equal(res.body.model, 'gpt-5.5');
+      assert.equal(res.body.configFile, '.codex/config.toml');
+      assert.equal(res.body.restartRequired, true);
+
+      const text = fs.readFileSync(path.join(configDir, 'config.toml'), 'utf8');
+      assert.equal(text, [
+        '# codex project config',
+        'model = "gpt-5.5"',
+        'model_provider = "openai"',
+        '',
+        '[model_providers.anthropic]',
+        'name = "anthropic"',
+      ].join('\n'), 'only the top-level model line may change; every other byte preserved');
+
+      const updated = registry.get(session.sessionId);
+      assert.equal(updated.model, 'gpt-5.5');
+      assert.equal(updated.restartRequired, true);
+      assert.ok(updated.restartRequiredFields.includes('model'), 'restartRequiredFields must include model');
+
+      const disk = JSON.parse(fs.readFileSync(
+        path.join(root, 'Harness', 'a2a', 'sessions', session.sessionId, 'STATE.json'), 'utf8'));
+      assert.equal(disk.model, 'gpt-5.5');
+      assert.equal(disk.restartRequired, true);
+    } finally {
+      fs.rmSync(configDir, { recursive: true, force: true });
+    }
+  });
+
+  it('M2: unknown node → 404', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/setmodel-does-not-exist/actions/agent.setModel`, {
+      method: 'POST',
+      body: { model: 'gpt-6' },
+    });
+    assert.equal(res.status, 404);
+    assert.equal(res.body.error.code, 'NOT_FOUND');
+  });
+
+  it('M3: runtime without a project config → 409 NO_PROJECT_MODEL_CONFIG', async () => {
+    // deepseek defines only a user-scope config (~/.deepseek/config.toml),
+    // so no project-scope model config is known for the runtime.
+    const { graphNodeId } = makeAgentNode(registry, root, { runtime: 'deepseek', graphNodeId: 'setmodel-m3' });
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.setModel`, {
+      method: 'POST',
+      body: { model: 'deepseek-v4' },
+    });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'NO_PROJECT_MODEL_CONFIG');
+  });
+
+  it('M4: empty model → 400', async () => {
+    const { graphNodeId } = makeAgentNode(registry, root, { runtime: 'codex', graphNodeId: 'setmodel-m4' });
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.setModel`, {
+      method: 'POST',
+      body: { model: '   ' },
+    });
+    assert.equal(res.status, 400);
+    assert.equal(res.body.error.code, 'BAD_REQUEST');
+  });
+
+  it('M5: user-scope config is never touched — only user config exists → 409', async () => {
+    // Seed the USER-scope codex config inside the redirected fake home; the
+    // project itself has no .codex/config.toml.
+    const userConfigPath = path.join(fakeHomeDir, '.codex', 'config.toml');
+    fs.mkdirSync(path.dirname(userConfigPath), { recursive: true });
+    fs.writeFileSync(userConfigPath, 'model = "user-model"\n', 'utf8');
+
+    const { graphNodeId } = makeAgentNode(registry, root, { runtime: 'codex', graphNodeId: 'setmodel-m5' });
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.setModel`, {
+      method: 'POST',
+      body: { model: 'gpt-6' },
+    });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'NO_PROJECT_MODEL_CONFIG');
+    assert.equal(fs.readFileSync(userConfigPath, 'utf8'), 'model = "user-model"\n', 'user-scoped config must remain untouched');
+  });
+
+  it('M6: JSON project config (.claude/settings.json) model updated, other fields preserved', async () => {
+    const settingsDir = path.join(root, '.claude');
+    fs.mkdirSync(settingsDir, { recursive: true });
+    try {
+      fs.writeFileSync(path.join(settingsDir, 'settings.json'), JSON.stringify({
+        model: 'claude-opus-4-0',
+        env: { MY_VAR: 'keep-me' },
+        permissions: { allow: ['Bash'] },
+      }, null, 2), 'utf8');
+
+      const { session, graphNodeId } = makeAgentNode(registry, root, { runtime: 'claude', graphNodeId: 'setmodel-m6' });
+      const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.setModel`, {
+        method: 'POST',
+        body: { model: 'claude-opus-4-1' },
+      });
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      assert.equal(res.body.configFile, '.claude/settings.json');
+      assert.equal(res.body.restartRequired, true);
+
+      const data = JSON.parse(fs.readFileSync(path.join(settingsDir, 'settings.json'), 'utf8'));
+      assert.equal(data.model, 'claude-opus-4-1');
+      assert.deepEqual(data.env, { MY_VAR: 'keep-me' });
+      assert.deepEqual(data.permissions, { allow: ['Bash'] });
+
+      const updated = registry.get(session.sessionId);
+      assert.equal(updated.model, 'claude-opus-4-1');
+      assert.equal(updated.restartRequired, true);
+    } finally {
+      fs.rmSync(settingsDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/wf-ui-server/__tests__/workflow-skill-group-context-enabled.test.mjs

@@ -0,0 +1,131 @@
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+// ── Helpers ──
+function tempProjectRoot() {
+  const id = crypto.randomBytes(4).toString('hex');
+  const dir = path.join(process.cwd(), '.tmp-skill-group-context-enabled-' + id);
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a', 'component-nodes'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'component-nodes', 'index.json'), JSON.stringify({ schemaVersion: 1, nodes: [] }));
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'workflow-map.json'), JSON.stringify({ schemaVersion: 1, version: 1, nodes: [], edges: [], positions: {}, undoStack: [], redoStack: [], deletedNodes: [] }));
+  return dir;
+}
+
+function cleanup(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+}
+
+function seedAgentGraphNode(root, nodeId = 'session-skill-context-agent-01', overrides = {}) {
+  const graph = runtime.loadWorkflowGraphMap(root);
+  const sessionId = overrides.sessionId || `${nodeId}-pty`;
+  runtime.writeWorkflowGraphMap(root, {
+    ...graph,
+    version: graph.version + 1,
+    nodes: [
+      ...(graph.nodes || []),
+      {
+        nodeId,
+        sessionId,
+        agentKind: overrides.agentKind || 'main',
+        runtime: overrides.runtime || 'codex',
+        status: overrides.status || 'stopped',
+        label: overrides.label || 'Skill Context Agent',
+        cwd: root,
+        taskId: null,
+        role: overrides.role || overrides.agentKind || 'main',
+      },
+    ],
+    positions: {
+      ...(graph.positions || {}),
+      [nodeId]: { x: 100, y: 120 },
+    },
+  });
+  return nodeId;
+}
+
+let runtime;
+let graphStore;
+let SkillGroupNode;
+
+before(async () => {
+  runtime = await import('../workflow-node-runtime.mjs');
+  graphStore = await import('../workflow-graph-store.mjs');
+  SkillGroupNode = await import('../workflow-node-types/skill-group-node.mjs');
+});
+
+describe('effectiveSkillGroups skillRefs enabled projection (W38-BE-FOLLOWUP)', () => {
+  const roots = [];
+  after(() => roots.forEach(cleanup));
+
+  function seedPack(root) {
+    return runtime.createNode(root, {
+      type: 'skill-group',
+      title: 'Agent Skill Pack',
+      sourceGroup: { id: 'source:workflow', label: 'Workflow', kind: 'source' },
+      skills: [
+        { id: 'skill:wf-ui', name: 'wf-ui', title: 'WF-UI Adapter', source: 'project' },
+        { id: 'skill:browser-lab', name: 'browser-lab', title: 'Browser Lab', source: 'project' },
+        { id: 'skill:api-lab', name: 'api-lab', title: 'API Lab', source: 'project' },
+      ],
+    });
+  }
+
+  it('projects enabled:false onto effectiveSkillGroups[].skillRefs after setSkillEnabled(false)', async () => {
+    const root = tempProjectRoot();
+    roots.push(root);
+    const pack = await seedPack(root);
+    const nodeId = pack.node.nodeId;
+    const agentId = seedAgentGraphNode(root);
+    graphStore.connectNodes(root, {
+      from: agentId,
+      to: nodeId,
+      relation: 'capability',
+      sourceHandle: 'right',
+      targetHandle: 'capability:left',
+    });
+
+    // Default state: every projected skillRef reports enabled:true
+    const before = await runtime.getNodeContext(root, agentId);
+    assert.equal(before.context.effectiveSkillGroups.length, 1);
+    const skillRefsBefore = before.context.effectiveSkillGroups[0].skillRefs;
+    assert.ok(Array.isArray(skillRefsBefore));
+    assert.equal(skillRefsBefore.length, 3);
+    for (const ref of skillRefsBefore) {
+      assert.equal(ref.enabled, true, `skill ${ref.name} should default to enabled:true`);
+    }
+
+    // Toggle one skill off
+    SkillGroupNode.setSkillEnabled(nodeId, root, { skillId: 'skill:browser-lab', enabled: false });
+
+    const after = await runtime.getNodeContext(root, agentId);
+    assert.equal(after.context.effectiveSkillGroups.length, 1);
+    const skillRefsAfter = after.context.effectiveSkillGroups[0].skillRefs;
+    const browserLab = skillRefsAfter.find(s => s.name === 'browser-lab');
+    const wfUi = skillRefsAfter.find(s => s.name === 'wf-ui');
+    const apiLab = skillRefsAfter.find(s => s.name === 'api-lab');
+    assert.equal(browserLab.enabled, false, 'toggled skill must surface enabled:false in skillRefs');
+    assert.equal(wfUi.enabled, true, 'untouched skills must remain enabled:true');
+    assert.equal(apiLab.enabled, true, 'untouched skills must remain enabled:true');
+
+    // Toggle back to true
+    SkillGroupNode.setSkillEnabled(nodeId, root, { skillId: 'skill:browser-lab', enabled: true });
+    const restored = await runtime.getNodeContext(root, agentId);
+    const skillRefsRestored = restored.context.effectiveSkillGroups[0].skillRefs;
+    const browserLabRestored = skillRefsRestored.find(s => s.name === 'browser-lab');
+    assert.equal(browserLabRestored.enabled, true, 'toggled-back skill must surface enabled:true in skillRefs');
+
+    // skillRefs remain body-free (no SKILL.md body, no absolute project path, no description)
+    const serialized = JSON.stringify(restored.context.effectiveSkillGroups);
+    assert.ok(!serialized.includes('SKILL.md'), 'effectiveSkillGroups.skillRefs must not leak SKILL.md body');
+    assert.ok(!serialized.includes(root), 'effectiveSkillGroups.skillRefs must not leak absolute project path');
+    for (const ref of skillRefsRestored) {
+      const keys = Object.keys(ref).sort();
+      // Body-free: only the lightweight projected fields are allowed
+      assert.deepEqual(keys, ['enabled', 'id', 'name', 'source', 'state', 'title'], `unexpected skillRef fields: ${keys.join(',')}`);
+    }
+  });
+});