drafted 1.24.3 → 1.24.5

package/mcp/test-org-guards.mjs

@@ -1,234 +0,0 @@
-// Regression check for the MCP org-ambiguity policy (DRAFT-36 "one rule").
-// Run: `node mcp/test-org-guards.mjs`. No framework — asserts the single pure
-// decision core that the org guard delegates to, for BOTH creates and forks.
-import assert from 'node:assert/strict';
-import { mkdtempSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg, splitOrgScope, stripUrlOrigin, rmScope, splitProjectTail } from './server.mjs';
-import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
-
-// One rule governs create AND fork (a fork is a create). A write proceeds when its
-// org is a real root — explicit org=, a bound/active project, or a single-org user's
-// only org. It refuses to GUESS only when the user is multi-org with nothing bound.
-assert.equal(projectlessMutationNeedsOrg({ explicitOrg: 'ee', orgCount: 5 }), false, 'explicit org → allow');
-assert.equal(projectlessMutationNeedsOrg({ boundOrgId: 'causeway', orgCount: 5 }), false, 'bound project → allow (a real root, not the cursor)');
-assert.equal(projectlessMutationNeedsOrg({ activeProjectId: 'p1', orgCount: 5 }), false, 'active project → allow');
-assert.equal(projectlessMutationNeedsOrg({ orgCount: 1 }), false, 'single org → allow');
-
-// A remote session is NOT a root. Its session org is the org the connection INHERITED
-// (the user's default), not one anybody chose — that inheritance wrote a Beoflow-bound
-// agent's wiki page into Personal. Multi-org remote must name its org like anyone else;
-// single-org remote stays frictionless (covered by the orgCount:1 case above).
-assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), true, 'remote + multi-org → BLOCK (its session org is inherited, not chosen)');
-assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 1 }), false, 'remote + single org → allow');
-assert.equal(projectlessMutationNeedsOrg({ orgCount: 0 }), false, 'unknown membership → allow (never block a legit write)');
-assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org, nothing bound → BLOCK (refuse to guess)');
-
-// The xcode-build incident state: multi-org + a bound project sticky from an
-// earlier, unrelated project(open). Under Reading A a fork is NOT hard-blocked —
-// it lands in the active project's org (a real root) and the response RECEIPT names
-// that org, so the fork is visible instead of silent. Create and fork agree here by
-// design (one rule); the fix for the surprise is the receipt, not a block.
-const incident = { orgCount: 3, boundOrgId: 'causeway', activeProjectId: 'p1' };
-assert.equal(projectlessMutationNeedsOrg(incident), false, 'incident state: fork allowed into the bound org — awareness comes from the receipt (Reading A)');
-
-// The genuinely ambiguous case still errors for a fork, exactly as for a create:
-assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org fork with nothing bound → BLOCK before any copy is created');
-
-// ── Persisted stdio state must not cross DATABASES ────────────────────────────
-// The 2026-07-31 incident: this repo registers a prod stdio MCP (drafted.live) and a
-// local-dev one (localhost:3477) that run in the SAME cwd. Keyed by cwd alone, the
-// local MCP's activeProject + boundOrgId were rehydrated by the prod MCP at boot, so
-// the prod session addressed every request to an org id that exists only in the local
-// dev DB: get_org reported `workingOrg {id: <local-uuid>, name: null}` in no membership
-// list, and project-less calls failed `not a member of org "<local-uuid>"`.
-const file = join(mkdtempSync(join(tmpdir(), 'drafted-state-')), 'mcp-state.json');
-const cwd = '/Users/x/GitHub/drafted.live';
-const PROD = 'https://drafted.live';
-const LOCAL = 'http://localhost:3477';
-
-savePersistedProject(
-  { activeProjectId: 'local-project', boundOrgId: 'b111302a-local-db-only' },
-  { file, cwd, serverUrl: LOCAL }
-);
-assert.equal(
-  loadPersistedProject({ file, cwd, serverUrl: PROD }),
-  null,
-  'prod MCP must NOT rehydrate the local dev MCP state saved in the same cwd'
-);
-assert.equal(
-  loadPersistedProject({ file, cwd, serverUrl: LOCAL })?.boundOrgId,
-  'b111302a-local-db-only',
-  'same server + same cwd still rehydrates (the feature this persistence exists for)'
-);
-
-savePersistedProject({ activeProjectId: 'prod-project', boundOrgId: 'org-prod' }, { file, cwd, serverUrl: PROD });
-assert.equal(loadPersistedProject({ file, cwd, serverUrl: PROD })?.activeProjectId, 'prod-project');
-assert.equal(
-  loadPersistedProject({ file, cwd, serverUrl: LOCAL })?.activeProjectId,
-  'local-project',
-  'the two servers keep independent entries for one cwd'
-);
-
-// A pre-fix (bare-cwd) entry carries no record of which server minted its ids, so it is
-// never adopted — that entry IS the poisoned state.
-savePersistedProject({ activeProjectId: 'legacy', boundOrgId: 'b111302a-local-db-only' }, { file, cwd });
-assert.equal(loadPersistedProject({ file, cwd, serverUrl: PROD })?.activeProjectId, 'prod-project',
-  'a legacy un-namespaced entry never leaks into a server-scoped read');
-
-// ── A non-member working org can never stay the silent default ────────────────
-const stale = 'b111302a-937c-489b-8cec-a422c853ce85';
-assert.equal(
-  boundOrgRejected({ message: `not a member of org "${stale}"`, boundOrgId: stale }),
-  true,
-  'server rejected the org WE addressed the request to → drop it and retry unaddressed'
-);
-assert.equal(
-  boundOrgRejected({ message: `not a member of org "${stale}"`, boundOrgId: stale, hasExplicitOrg: true }),
-  false,
-  'an explicit org= is the CALLER\'s address — surface the error, never silently drop it'
-);
-assert.equal(
-  boundOrgRejected({ message: 'not a member of org "Drafted"', boundOrgId: stale }),
-  false,
-  'a rejection naming a DIFFERENT org is not ours to heal'
-);
-assert.equal(boundOrgRejected({ message: 'Project not found', boundOrgId: stale }), false, 'unrelated error → no heal');
-assert.equal(boundOrgRejected({ message: `not a member of org "${stale}"` }), false, 'nothing bound → nothing to drop');
-
-// ── receiptOrg: the mutation receipt must name where the write LANDED ─────────
-// Regression for the sibling of the foreign-org bug: a UUID-addressed page
-// self-derives its org server-side, so echoing the session's working org made
-// `org:` disagree with the (correct) `url:` on a cross-org edit.
-{
-  const ORGS = [
-    { id: 'org-a', name: 'Alpha' },
-    { id: 'org-b', name: 'Bravo' },
-  ];
-  const SESSION = { id: 'org-a', name: 'Alpha' };
-
-  // resource lives in the session's own org → session context, unchanged
-  assert.deepEqual(
-    receiptOrg({ resourceOrgId: 'org-a', sessionOrg: SESSION, orgList: ORGS }),
-    SESSION,
-    'same-org write should echo the session org',
-  );
-
-  // response carries no org (path-addressed) → fall back to session context
-  assert.deepEqual(
-    receiptOrg({ resourceOrgId: null, sessionOrg: SESSION, orgList: ORGS }),
-    SESSION,
-    'no resource org should fall back to the session org',
-  );
-
-  // THE BUG: resource lives elsewhere → must name the resource's org, not the session's
-  assert.deepEqual(
-    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: SESSION, orgList: ORGS }),
-    { id: 'org-b', name: 'Bravo' },
-    'cross-org write must echo the org the write landed in',
-  );
-
-  // resource org not in the membership list → still name it, honestly, rather
-  // than silently substituting the session org
-  assert.deepEqual(
-    receiptOrg({ resourceOrgId: 'org-z', sessionOrg: SESSION, orgList: ORGS }),
-    { id: 'org-z', name: null },
-    'unknown resource org should be named with a null name, not swapped out',
-  );
-
-  // no session org at all (unbound) and a resource org present
-  assert.deepEqual(
-    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: null, orgList: ORGS }),
-    { id: 'org-b', name: 'Bravo' },
-    'unbound session should still name the resource org',
-  );
-}
-
-// Shape A grammar: org is the top folder of the filesystem (/o/<org>/<root>/...).
-// The org segment is stripped for the root handlers and carried as the per-request
-// scope; bare roots stay accepted (backward compat, session working org).
-assert.deepEqual(splitOrgScope('/o/acme/wiki/engineering/authz.md'), { path: '/wiki/engineering/authz.md', org: 'acme' }, 'org-scoped wiki path strips to the bare root + org');
-assert.deepEqual(splitOrgScope('/o/acme/projects/design/beoflow/wireframes/x.html'), { path: '/projects/design/beoflow/wireframes/x.html', org: 'acme' }, 'org-scoped project path strips to the bare root + org');
-assert.deepEqual(splitOrgScope('/o/acme'), { path: '/', org: 'acme' }, 'ls /o/<org> lists that org\'s roots');
-assert.deepEqual(splitOrgScope('/o/acme/'), { path: '/', org: 'acme' }, 'trailing slash on the org root is harmless');
-assert.deepEqual(splitOrgScope('/o/acme%20brand/skills'), { path: '/skills', org: 'acme brand' }, 'org segment is URL-decoded');
-assert.deepEqual(splitOrgScope('/o/acme/tasks'), { path: '/tasks', org: 'acme' }, 'the tasks root is a root like any other');
-assert.deepEqual(splitOrgScope('/o/acme/tasks/sprint-1/ship-it.md'), { path: '/tasks/sprint-1/ship-it.md', org: 'acme' }, 'a lane + file under /tasks strips to the bare root + org');
-assert.deepEqual(splitOrgScope('/wiki/engineering'), { path: '/wiki/engineering', org: null }, 'bare root paths pass through untouched');
-assert.deepEqual(splitOrgScope('/projects/x/y/z.html'), { path: '/projects/x/y/z.html', org: null }, 'bare project paths pass through untouched');
-assert.ok(splitOrgScope('/o/').error, 'a bare /o/ is an invalid org-scoped path');
-assert.ok(splitOrgScope('/o/').error?.includes('expected /o/<org>/<root>'), 'error names the expected grammar');
-
-// Full share URLs (Q2): the URL's pathname IS the fs path — stripping the origin must
-// leave an addressable path, and non-URL inputs pass through untouched.
-assert.equal(stripUrlOrigin('https://drafted.live/o/acme/wiki/engineering/authz.md'), '/o/acme/wiki/engineering/authz.md', 'full URL strips to its pathname');
-assert.equal(stripUrlOrigin('https://drafted.live/o/acme/projects/beoflow/designs/pricing/hero.html?x=1'), '/o/acme/projects/beoflow/designs/pricing/hero.html', 'URL query params are dropped with the origin');
-assert.equal(stripUrlOrigin('/o/acme/wiki/x'), '/o/acme/wiki/x', 'plain paths pass through untouched');
-assert.equal(stripUrlOrigin('not a url'), 'not a url', 'non-URL input passes through');
-assert.equal(stripUrlOrigin('/f/00000000-0000-0000-0000-000000000000'), '/f/00000000-0000-0000-0000-000000000000', '/f/ frame links pass through');
-
-// fs(rm) scope: only a BARE project path may archive a project. A lane path
-// (/slides/deck) and a layer path (/slides) both parse with filename=null and
-// used to fall through to the archive branch, silently archiving the whole
-// project with a success-shaped response.
-assert.equal(rmScope('slides', 'deck', '12.html'), 'file', 'a full frame path removes that frame');
-assert.equal(rmScope('slides', null, '12.html'), 'file', 'a layer-root file path removes that frame');
-assert.equal(rmScope('slides', 'deck', null), 'directory', 'a LANE path must never archive the project');
-assert.equal(rmScope('slides', null, null), 'directory', 'a LAYER path must never archive the project');
-assert.equal(rmScope(null, null, null), 'project', 'only the bare project path archives the project');
-
-// fs(mv) reads the SAME three scopes, which is why they share one predicate: a
-// file path moves one frame, a lane/layer path moves the whole set, and a bare
-// project path renames the project. mv used to assume 'file' at every scope and
-// built "/slides/deck/null" for a lane — a 404 that read as "lanes cannot move".
-assert.equal(rmScope('slides', 'deck', null), 'directory', 'mv on a LANE path moves the lane, not a frame called null');
-assert.equal(rmScope('slides', null, null), 'directory', 'mv on a LAYER path moves the layer');
-assert.equal(rmScope(null, null, null), 'project', 'mv on a bare project path renames the project');
-
-// splitProjectTail: everything AFTER the project segment. It reads the tail only,
-// so the folder chain in front of the project cannot shift the layer/lane/file
-// the way the old positional `parts.length ===` branches did — that is what made
-// /projects/Marketing/beoflow-marketing answer "project not found: Marketing".
-{
-  const t = (tail, expected, why) => assert.deepEqual(splitProjectTail(tail), expected, why);
-  t([], { layer: undefined, lane: null, filename: null }, 'no tail = the project itself');
-  t(['designs'], { layer: 'designs', lane: null, filename: null }, 'one segment = a layer');
-  t(['designs', 'default'], { layer: 'designs', lane: 'default', filename: null }, 'no extension = a lane');
-  t(['designs', 'a.html'], { layer: 'designs', lane: null, filename: 'a.html' }, 'an extension = a layer-root file');
-  t(['designs', 'default', 'a.html'], { layer: 'designs', lane: 'default', filename: 'a.html' }, 'the full frame path');
-  // A lane may legitimately be named after a layer; treating it as a file here
-  // would send the read to /designs/designs and 404 on a lane that exists.
-  t(['plans', 'designs'], { layer: 'plans', lane: 'designs', filename: null }, 'a layer NAME as the last segment is still a lane');
-}
-
-console.log('org-guard policy OK');
-// Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
-// loop that keeps the event loop alive. Assertions are done — exit deterministically.
-// ── searchNeedsOrg: stricter than a mutation, on purpose ───────────
-// A mutation credits a bound project because its receipt names the destination.
-// A search has no such tell: scoping it from an unstated binding yields an empty
-// result the agent reads as "does not exist anywhere". Only a NAMED org counts.
-{
-  const { searchNeedsOrg } = await import('./server.mjs');
-  const t = (label, args, expected) => {
-    const got = searchNeedsOrg(args);
-    if (got !== expected) {
-      console.error(`FAIL searchNeedsOrg: ${label} -> ${got}, expected ${expected}`);
-      process.exitCode = 1;
-    } else console.log(`ok  searchNeedsOrg: ${label}`);
-  };
-
-  t('multi-org, nothing named -> REFUSE', { orgCount: 3 }, true);
-  t('org in the path -> proceed', { orgFromPath: 'beoflow', orgCount: 3 }, false);
-  t('explicit org= -> proceed', { explicitOrg: 'beoflow', orgCount: 3 }, false);
-  t('single org -> proceed (nothing to be fenced from)', { orgCount: 1 }, false);
-  t('zero/unknown orgs -> proceed, never block on unknown membership', { orgCount: 0 }, false);
-  // The divergence from the mutation rule is the whole point: a binding does NOT
-  // satisfy a search, because the caller never stated the scope.
-  t('bound project does NOT satisfy a search', { activeProjectId: 'p1', boundOrgId: 'o1', orgCount: 2 }, true);
-}
-
-// Must exit: importing server.mjs opens the MCP WebSocket at module scope and
-// pins the event loop (AGENTS.md).
-process.exit(process.exitCode || 0);

package/mcp/test-project-index.mjs

@@ -1,88 +0,0 @@
-#!/usr/bin/env node
-// Regression for the `ls /projects` shape: the old response returned raw
-// /api/projects rows (~2.4KB each once `layers` is pretty-printed), so 180
-// projects blew the 90KB tool-result cap and truncated mid-JSON at 38.
-// These assert the two properties that keep that from recurring: a bounded,
-// line-per-project shape, and recency ordering so truncation drops the dead
-// tail rather than the live projects.
-//
-// Run: node mcp/test-project-index.mjs
-import assert from 'node:assert/strict';
-import { formatProjectIndex, projectPath } from './gates.mjs';
-
-const NOW = Date.UTC(2026, 7, 31);
-const day = 86400000;
-
-const mk = (n, over = {}) => ({
-  id: `id-${n}`,
-  name: `Project ${n}`,
-  slug: `project-${n}`,
-  orgSlug: 'acme',
-  folder: null,
-  frameCount: 3,
-  createdAt: new Date(NOW - 400 * day).toISOString(),
-  updatedAt: new Date(NOW - n * day).toISOString(),
-  ...over,
-});
-
-// ── path shape ───────────────────────────────────────────────────────────────
-assert.equal(projectPath(mk(1)), '/o/acme/projects/project-1');
-assert.equal(projectPath(mk(1, { folder: 'clients' })), '/o/acme/projects/clients/project-1');
-assert.equal(projectPath({ orgId: 'org-uuid', id: 'p-uuid' }), '/o/org-uuid/projects/p-uuid');
-
-// ── empty ────────────────────────────────────────────────────────────────────
-assert.match(formatProjectIndex([]), /no projects/i);
-
-// ── the reported failure: 180 projects must stay far under the 90KB cap ──────
-const many = Array.from({ length: 180 }, (_, i) => mk(i + 1));
-const out = formatProjectIndex(many, { now: NOW });
-assert.ok(out.length < 10_000, `180 projects rendered ${out.length} chars, expected <10KB`);
-assert.match(out, /^180 projects/, 'header reports the true total, not the shown count');
-assert.match(out, /…and 130 more/, 'tail names what was withheld');
-assert.equal(out.split('\n').filter((l) => l.startsWith('  /o/')).length, 50, 'caps at 50 lines');
-
-// Recency order: newest-touched first, so the tail that gets cut is the stale end.
-const shownPaths = out.split('\n').filter((l) => l.startsWith('  /o/')).map((l) => l.trim().split(/\s+/)[0]);
-assert.equal(shownPaths[0], '/o/acme/projects/project-1', 'most recently touched leads');
-assert.equal(shownPaths[49], '/o/acme/projects/project-50');
-assert.ok(!out.includes('project-180'), 'stale tail is the part dropped');
-
-// updatedAt wins over createdAt even when createdAt ordering disagrees.
-const stale = mk(1, { slug: 'old-but-busy', createdAt: new Date(NOW - 900 * day).toISOString(), updatedAt: new Date(NOW - 1 * day).toISOString() });
-const fresh = mk(2, { slug: 'new-but-idle', createdAt: new Date(NOW - 2 * day).toISOString(), updatedAt: new Date(NOW - 300 * day).toISOString() });
-const ordered = formatProjectIndex([fresh, stale], { now: NOW });
-assert.ok(ordered.indexOf('old-but-busy') < ordered.indexOf('new-but-idle'), 'sorts on updatedAt, not createdAt');
-
-// Missing activity data must not crash or sort to the top.
-const noStats = formatProjectIndex([{ id: 'x', slug: 'bare', orgSlug: 'acme' }, mk(1)], { now: NOW });
-assert.match(noStats, /\/o\/acme\/projects\/bare/);
-
-// ── header carries the session binding, not a shared cursor ──────────────────
-const bound = formatProjectIndex([mk(1)], { boundPath: '/o/acme/projects/project-1', now: NOW });
-assert.match(bound, /bound: \/o\/acme\/projects\/project-1/);
-assert.ok(!formatProjectIndex([mk(1)], { now: NOW }).includes('bound:'), 'no binding, no bound line');
-
-// Multi-org listings say so; single-org ones stay quiet.
-const multi = formatProjectIndex([mk(1), mk(2, { orgSlug: 'globex' })], { now: NOW });
-assert.match(multi, /2 orgs/);
-assert.ok(!formatProjectIndex([mk(1), mk(2)], { now: NOW }).includes('orgs'));
-
-// ── ages ─────────────────────────────────────────────────────────────────────
-const ages = formatProjectIndex([
-  mk(1, { slug: 'a', updatedAt: new Date(NOW).toISOString() }),
-  mk(2, { slug: 'b', updatedAt: new Date(NOW - 3 * day).toISOString() }),
-  mk(3, { slug: 'c', updatedAt: new Date(NOW - 21 * day).toISOString() }),
-  mk(4, { slug: 'd', updatedAt: new Date(NOW - 90 * day).toISOString() }),
-], { now: NOW });
-for (const [slug, age] of [['a', 'today'], ['b', '3d'], ['c', '3w'], ['d', '3mo']]) {
-  assert.match(ages, new RegExp(`projects/${slug}\\s+3 frames\\s+${age}\\b`), `${slug} → ${age}`);
-}
-
-// Frame count reads as English, and absent counts render no column at all.
-assert.match(formatProjectIndex([mk(1, { frameCount: 1 })], { now: NOW }), /1 frame\s+1d/);
-assert.match(formatProjectIndex([mk(1, { frameCount: 0 })], { now: NOW }), /0 frames\s+1d/);
-const noCount = formatProjectIndex([mk(1, { frameCount: undefined })], { now: NOW });
-assert.ok(!noCount.includes('frame'), 'no frameCount, no frames column');
-assert.match(noCount, /1d$/m, 'age still renders without a count');
-
-console.log('ok — project index shape, ordering, bounds');

package/mcp/test-search-terms.mjs

@@ -1,79 +0,0 @@
-// Regression for fs(search) term matching on /projects.
-// Run: `node mcp/test-search-terms.mjs`. No framework — asserts the pure core.
-//
-// Why this exists: search used to substring-test the WHOLE query against each
-// field, so `query="tool surface parity MCP Flow"` missed a project whose
-// description says "tool surface" and "parity" — while `query="parity"` hit it.
-// An agent reads that miss as "the project does not exist" and stops looking.
-import assert from 'node:assert/strict';
-import { matchesAllTerms, formatFrameHits, archivedNote, clip } from './server.mjs';
-
-const proj = [
-  'Flow AI MCP Server Feature Card',
-  'flow-ai-mcp-server-feature-card',
-  'Covers the BEO-2527 parity guard for the agent tool surface.',
-];
-
-// The reported failure: a natural multi-word query spanning name AND description.
-assert.equal(matchesAllTerms(proj, 'tool surface parity MCP Flow'), true);
-// The single word that did work must keep working.
-assert.equal(matchesAllTerms(proj, 'parity'), true);
-// Terms match across fields and across a hyphenated slug.
-assert.equal(matchesAllTerms(proj, 'flow feature card'), true);
-assert.equal(matchesAllTerms(proj, 'BEO-2527'), true);
-// Case and surrounding whitespace are irrelevant.
-assert.equal(matchesAllTerms(proj, '  PARITY   Guard '), true);
-
-// AND, not OR: one unmatched term is a miss. An OR would return most of the org.
-assert.equal(matchesAllTerms(proj, 'parity kubernetes'), false);
-assert.equal(matchesAllTerms(proj, 'kubernetes'), false);
-
-// An empty query never matches — the caller rejects it before this, and
-// "every term" over zero terms would otherwise be vacuously true for every row.
-assert.equal(matchesAllTerms(proj, ''), false);
-assert.equal(matchesAllTerms(proj, '   '), false);
-assert.equal(matchesAllTerms(proj, undefined), false);
-
-// Null/undefined fields don't throw or match a stray "null"/"undefined" term.
-assert.equal(matchesAllTerms([null, undefined, 'alpha'], 'alpha'), true);
-assert.equal(matchesAllTerms([null, undefined, 'alpha'], 'null'), false);
-
-// ── Frame hit rendering (docs/plans/frame-content-search.md, Phase 2) ────────
-const hit = {
-  orgSlug: 'beoflow', projectSlug: 'flow-ai-mcp-server-feature-card',
-  layer: 'plans', lane: 'phase-0', label: 'feature-plan.md',
-  snippet: 'the BEO-2527 «parity guard» runs\n  before every diff',
-};
-const rendered = formatFrameHits([hit]);
-assert.match(rendered, /\/o\/beoflow\/projects\/flow-ai-mcp-server-feature-card\/plans\/phase-0\/feature-plan\.md/);
-// The snippet is the evidence — it must survive, with its newlines flattened so
-// one hit stays one block instead of wrapping into the next path.
-assert.match(rendered, /«parity guard» runs before every diff/);
-assert.equal(rendered.split('\n').length, 2);
-
-// A hit with no snippet matched the LABEL, not content. Say so rather than
-// rendering a bare path that looks identical to a content match.
-assert.match(formatFrameHits([{ ...hit, snippet: null }]), /\(label match\)$/);
-assert.match(formatFrameHits([{ ...hit, snippet: '   ' }]), /\(label match\)$/);
-
-// A lane-less frame must not render a doubled slash — that path is not addressable.
-assert.ok(!formatFrameHits([{ ...hit, lane: null }]).includes('//'));
-
-// The cap is a cap; nothing renders beyond it.
-assert.equal(formatFrameHits(Array(40).fill({ ...hit, snippet: null }), { limit: 3 }).split('\n').length, 3);
-
-// Archived matches are counted, never silently dropped — and zero says nothing.
-assert.equal(archivedNote(0), '');
-assert.match(archivedNote(2), /2 more in archived projects/);
-
-// A result is a pointer, not the document: long fields are clipped so 25 hits
-// stay readable in-band instead of spilling to a file.
-assert.equal(clip('short', 20), 'short');
-assert.equal(clip('x'.repeat(50), 20).length, 20);
-assert.match(clip('x'.repeat(50), 20), /…$/);
-assert.equal(clip(null, 20), '');
-const long = formatFrameHits([{ ...hit, snippet: 'w '.repeat(400) }], { snippetChars: 60 });
-assert.ok(long.split('\n')[1].length <= 60 + 6, 'snippet line stays within its cap + indent');
-
-console.log('search term matching + frame hit rendering ok');
-process.exit(0);

package/mcp/test-skill-paths.mjs

@@ -1,29 +0,0 @@
-// Regression for the /skills path split used by fs(ls|read|write|rm).
-// Run: `node mcp/test-skill-paths.mjs`. No framework — asserts the pure core.
-//
-// Why this exists: a skill is a directory. Before this split the handler kept
-// only the first segment, so `fs(write, path="/skills/<slug>/README.md")` wrote
-// SKILL.md instead — the agent's README landed on top of the skill body and the
-// create-time README gate stayed unsatisfiable. isSkillMd is the load-bearing
-// bit: true routes to the skills row, false routes to skill_files.
-import assert from 'node:assert/strict';
-import { splitSkillPath } from './server.mjs';
-
-// Root and bare slug — no file, so the skill row itself.
-assert.deepEqual(splitSkillPath('/skills'), { slug: '', filePath: '', isSkillMd: true });
-assert.deepEqual(splitSkillPath('/skills/'), { slug: '', filePath: '', isSkillMd: true });
-assert.deepEqual(splitSkillPath('/skills/my-skill'), { slug: 'my-skill', filePath: '', isSkillMd: true });
-assert.deepEqual(splitSkillPath('/skills/my-skill/'), { slug: 'my-skill', filePath: '', isSkillMd: true });
-
-// SKILL.md is the skill body, addressed explicitly — same destination as the bare slug.
-assert.deepEqual(splitSkillPath('/skills/my-skill/SKILL.md'), { slug: 'my-skill', filePath: 'SKILL.md', isSkillMd: true });
-
-// Everything else is a supporting file, and the subpath survives.
-assert.deepEqual(splitSkillPath('/skills/my-skill/README.md'), { slug: 'my-skill', filePath: 'README.md', isSkillMd: false });
-assert.deepEqual(splitSkillPath('/skills/my-skill/references/api.md'), { slug: 'my-skill', filePath: 'references/api.md', isSkillMd: false });
-
-// Case matters: readme.md is a different file from README.md, and neither is SKILL.md.
-assert.equal(splitSkillPath('/skills/s/skill.md').isSkillMd, false);
-
-console.log('skill path split ok — SKILL.md routes to the skill row, everything else to skill files');
-process.exit(0);