forgedock 1.26.0 → 1.28.0

package/bin/lean/ledger.mjs

@@ -0,0 +1,92 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Lane resource ledger (#4179): `~/.forge/ledger/<batch>/<lane>.json` lists every resource a lane owns (worktree, branch,
+ * run tmp, spawned pids, containers/volumes the builder reported) with owner, batch, lane, issue, created and expires.
+ * Each resource is registered BEFORE it is created and released only after its teardown succeeded, so a lane that dies
+ * leaves an exact record behind. A `sandbox` entry (#4253, execution.mjs) carries `{provider, handle}` (never a secret);
+ * a file listing only sandboxes is a remote lane, not a lane on this host. Teardown acts only on what the ledger lists; this module itself only reads and writes
+ * the ledger file (no git, gh, docker or kill calls).
+ */
+import * as nodeFs from "node:fs";
+import { homedir, hostname } from "node:os";
+import { join } from "node:path";
+
+export const ledgerRoot = () => join(homedir(), ".forge", "ledger");
+export const LEDGER_TTL_MS = 6 * 3600 * 1000;
+export const LEDGER_KINDS = Object.freeze(["worktree", "branch", "tmp", "pid", "container", "volume", "sandbox"]);
+/** A path segment that cannot escape the root: [A-Za-z0-9._-] only, never "." or "..". */
+export const safeSegment = (s) => { const v = String(s ?? "").replace(/[^A-Za-z0-9._-]/g, "_"); return !v || /^\.+$/.test(v) ? "_" : v; };
+
+const pidAlive = (pid) => { try { process.kill(pid, 0); return true; } catch (e) { return e?.code === "EPERM"; } };
+
+/**
+ * Live lanes on this host (#4182): lane files under `<root>/<batch>/` whose host is `host`, whose pid is alive and whose
+ * expiry is in the future. A file listing only `sandbox` resources (#4253) runs off this host and is not counted. Read-only: never writes or deletes; unreadable or malformed files are skipped.
+ */
+export function countLiveLanes({ root = ledgerRoot(), host = hostname(), now = () => Date.now(), alive = pidAlive, fs = nodeFs } = {}) {
+  let n = 0, batches = [];
+  try { batches = fs.readdirSync(root); } catch { return 0; }
+  for (const b of batches) {
+    let names = [];
+    try { names = fs.readdirSync(join(root, b)); } catch { continue; }
+    for (const f of names) {
+      if (!f.endsWith(".json")) continue;
+      try {
+        const j = JSON.parse(fs.readFileSync(join(root, b, f), "utf8"));
+        const remote = Array.isArray(j?.resources) && j.resources.length > 0 && j.resources.every((r) => r?.kind === "sandbox");
+        if (j && !remote && j.host === host && Number.isSafeInteger(j.pid) && j.pid > 0 && Number(j.expires) > now() && alive(j.pid)) n++;
+      } catch { /* not a lane file */ }
+    }
+  }
+  return n;
+}
+
+/** Docker ownership labels (#4181): owner, batch, lane, issue, expires (epoch ms, as the ledger), values [A-Za-z0-9_.-] only. */
+export function dockerLabels({ batch, lane, issue, expires } = {}) {
+  const v = (x) => String(x ?? "").replace(/[^A-Za-z0-9_.-]/g, "-") || "unknown";
+  return [`forgedock.owner=1`, `forgedock.batch=${v(batch)}`, `forgedock.lane=${v(lane)}`, `forgedock.issue=${v(issue)}`, `forgedock.expires=${v(expires)}`];
+}
+
+export function makeLedger({ root = ledgerRoot(), batch = "adhoc", lane, owner, issue, host = hostname(), pid = process.pid, now = () => Date.now(), ttlMs = LEDGER_TTL_MS, fs = nodeFs } = {}) {
+  const dir = join(root, safeSegment(batch));
+  const path = join(dir, `${safeSegment(lane ?? `lane-${issue}`)}.json`);
+  const read = () => { try { const j = JSON.parse(fs.readFileSync(path, "utf8")); return j && typeof j === "object" && Array.isArray(j.resources) ? j : null; } catch { return null; } };
+  const write = (j) => {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(j, null, 2) + "\n");
+    fs.renameSync(tmp, path);
+  };
+  const fresh = () => { const c = now(); return { v: 1, owner, batch: String(batch), lane: String(lane ?? `lane-${issue}`), issue, host, pid, created: c, expires: c + ttlMs, resources: [] }; };
+  const same = (r, kind, value) => r.kind === kind && String(r.value) === String(value);
+  return {
+    path,
+    read,
+    /** Idempotent; call BEFORE the resource is created. `extra` (e.g. {marker}) is kept on the entry. */
+    register(kind, value, extra = {}) {
+      if (!LEDGER_KINDS.includes(kind) || value == null || value === "") return false;
+      const j = read() ?? fresh();
+      Object.assign(j, { owner, host, pid, expires: now() + ttlMs });
+      if (!j.resources.some((r) => same(r, kind, value))) j.resources.push({ kind, value, ...extra, registered: now() });
+      write(j);
+      return true;
+    },
+    release(kind, value) {
+      const j = read();
+      if (!j) return false;
+      const n = j.resources.length;
+      j.resources = j.resources.filter((r) => !same(r, kind, value));
+      if (j.resources.length !== n) write(j);
+      return j.resources.length !== n;
+    },
+    entries(kind) { return (read()?.resources ?? []).filter((r) => !kind || r.kind === kind); },
+    /** Delete the file only when it lists nothing; a non-empty ledger stays for the next run or the reaper. */
+    remove() {
+      const j = read();
+      if (j && j.resources.length) return false;
+      try { fs.rmSync(path, { force: true }); } catch { return false; }
+      return true;
+    },
+  };
+}

package/bin/lean/ledger.test.mjs

@@ -0,0 +1,100 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { makeLedger, countLiveLanes, safeSegment, LEDGER_TTL_MS, dockerLabels } from "./ledger.mjs";
+
+describe("lane resource ledger (#4179)", () => {
+  it("register/release round trip carries owner, batch, lane, issue, created and expires", () => {
+    const root = tmpDir("ledger-");
+    let t = 1000;
+    const l = makeLedger({ root, batch: "b20261019-1", lane: "lean-7", owner: "core_1", issue: 7, host: "h", pid: 11, now: () => t });
+    assert.equal(l.path, join(root, "b20261019-1", "lean-7.json"));
+    assert.equal(l.read(), null);
+    assert.equal(l.register("worktree", "/wt/lean-7"), true);
+    l.register("branch", "feat/issue-7-lean");
+    l.register("pid", 4242, { marker: "claude" });
+    l.register("worktree", "/wt/lean-7"); // idempotent
+    t = 2000;
+    l.register("container", "lean7-pg");
+    const j = JSON.parse(readFileSync(l.path, "utf8"));
+    assert.deepEqual({ owner: j.owner, batch: j.batch, lane: j.lane, issue: j.issue, host: j.host, pid: j.pid, created: j.created }, { owner: "core_1", batch: "b20261019-1", lane: "lean-7", issue: 7, host: "h", pid: 11, created: 1000 });
+    assert.equal(j.expires, 2000 + LEDGER_TTL_MS, "each registration extends expiry");
+    assert.deepEqual(j.resources.map((r) => `${r.kind}:${r.value}`), ["worktree:/wt/lean-7", "branch:feat/issue-7-lean", "pid:4242", "container:lean7-pg"]);
+    assert.equal(l.entries("pid")[0].marker, "claude");
+    assert.equal(l.register("nonsense", "x"), false, "unknown kinds are refused");
+    assert.equal(l.release("pid", "4242"), true);
+    assert.equal(l.release("pid", 4242), false);
+    assert.equal(l.remove(), false, "a ledger that still lists resources is kept");
+    for (const r of l.entries()) l.release(r.kind, r.value);
+    assert.equal(l.remove(), true);
+    assert.equal(existsSync(l.path), false);
+  });
+
+  it("writes are atomic (no tmp file left behind) and names cannot escape the root", () => {
+    const root = tmpDir("ledger-");
+    const l = makeLedger({ root, batch: "../../etc", lane: "../passwd", issue: 1 });
+    l.register("tmp", "/x");
+    assert.equal(dirname(dirname(l.path)), root);
+    assert.deepEqual(readdirSync(dirname(l.path)), [l.path.split("/").at(-1)]);
+    for (const [i, o] of [["..", "_"], [".", "_"], ["", "_"], ["a/b", "a_b"], ["milestone/x", "milestone_x"], ["b1.2", "b1.2"]]) assert.equal(safeSegment(i), o);
+  });
+
+  it("a simulated crash (no teardown) leaves every registered resource readable by a fresh process", () => {
+    const root = tmpDir("ledger-");
+    const l = makeLedger({ root, batch: "b1", lane: "lean-9", owner: "core_9", issue: 9 });
+    for (const [k, v] of [["tmp", "/home/x/.forge/tmp/runs/9-1"], ["branch", "feat/issue-9-lean"], ["worktree", "/wt/lean-9"], ["pid", 77]]) l.register(k, v);
+    // the process dies here: nothing is released
+    const after = makeLedger({ root, batch: "b1", lane: "lean-9", issue: 9 }).read();
+    assert.equal(after.owner, "core_9");
+    assert.deepEqual(after.resources.map((r) => r.kind), ["tmp", "branch", "worktree", "pid"]);
+  });
+});
+
+describe("live lane count (#4182)", () => {
+  it("counts only live, same-host, unexpired lane files across batches, and deletes nothing", async () => {
+    const { mkdirSync, writeFileSync } = await import("node:fs");
+    const root = tmpDir("ledger-count-");
+    const t = 10_000;
+    const lane = (batch, name, o) => { mkdirSync(join(root, batch), { recursive: true }); writeFileSync(join(root, batch, `${name}.json`), typeof o === "string" ? o : JSON.stringify({ v: 1, host: "h", pid: 11, expires: t + 1, resources: [], ...o })); };
+    lane("b1", "lean-1", {});
+    lane("b1", "lean-2", { pid: 12 });
+    lane("adhoc", "lean-3", { pid: 13 });
+    lane("b1", "dead", { pid: 99 });
+    lane("b1", "other-host", { host: "zzz" });
+    lane("b1", "expired", { expires: t });
+    lane("b1", "malformed", "{not json");
+    lane("b1", "no-pid", { pid: null });
+    writeFileSync(join(root, "b1", "lean-1.json.tmp-5"), "{}");
+    writeFileSync(join(root, "stray-file"), "x");
+    const before = readdirSync(join(root, "b1")).sort();
+    const seen = [];
+    const n = countLiveLanes({ root, host: "h", now: () => t, alive: (pid) => { seen.push(pid); return pid !== 99; } });
+    assert.equal(n, 3);
+    assert.ok(!seen.includes(null));
+    assert.deepEqual(readdirSync(join(root, "b1")).sort(), before, "read-only");
+    assert.equal(countLiveLanes({ root: join(root, "missing"), host: "h" }), 0);
+  });
+
+  it("a registered lane counts itself by default (own pid alive)", () => {
+    const root = tmpDir("ledger-self-");
+    const l = makeLedger({ root, batch: "adhoc", lane: "lean-9", owner: "core_1", issue: 9, host: "h" });
+    assert.equal(countLiveLanes({ root, host: "h" }), 0, "nothing registered yet: no file");
+    l.register("tmp", "/x/runs/9-1");
+    assert.equal(countLiveLanes({ root, host: "h" }), 1);
+    assert.equal(countLiveLanes({ root, host: "other" }), 0);
+  });
+});
+
+describe("docker ownership labels (#4181)", () => {
+  it("owner, batch, lane, issue and expires, in order; values cannot inject", () => {
+    assert.deepEqual(dockerLabels({ batch: "b1", lane: "lean-7", issue: 7, expires: 123 }),
+      ["forgedock.owner=1", "forgedock.batch=b1", "forgedock.lane=lean-7", "forgedock.issue=7", "forgedock.expires=123"]);
+    const l = dockerLabels({ batch: "a b;rm -rf", lane: "", issue: null, expires: undefined });
+    assert.equal(l[1], "forgedock.batch=a-b-rm--rf"); assert.equal(l[2], "forgedock.lane=unknown"); assert.equal(l[3], "forgedock.issue=unknown");
+    for (const e of l) assert.match(e, /^forgedock\.[a-z]+=[A-Za-z0-9_.-]+$/);
+  });
+});

package/bin/lean/limits.mjs

@@ -0,0 +1,58 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Account-scoped usage-limit holds (#4190). A usage limit belongs to the account a lane runs on, not to a batch: holds
+ * live in one host-level file, `~/.forge/limits.json` (or `FORGEDOCK_LIMITS_FILE`), keyed by `backendIdentity`, so two
+ * batches on the same account share one hold and a lane on another account is admitted. `forgedock limits show|clear`
+ * inspects and clears them. Every write is a fresh read-modify-write through `writeAtomic`; a missing or corrupt file
+ * reads as no holds (fail-open: a lost hold costs one more limited lane, a stuck one stalls every batch).
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { backendIdentity } from "../engine.mjs";
+import { writeAtomic } from "./batch.mjs";
+
+/** Identity of the account a core lane runs on: the lane always uses the claude CLI with the dispatcher's env. */
+export function laneBackendId(env = process.env) {
+  return backendIdentity({ backend: "cli", env });
+}
+
+export function limitsFile(env = process.env) {
+  return env.FORGEDOCK_LIMITS_FILE || join(homedir(), ".forge", "limits.json");
+}
+
+/** Handle on the hold store. @returns {{holdUntil, set, clear, clearAll, list}} */
+export function openLimits(file = limitsFile(), { now = () => Date.now() } = {}) {
+  const read = () => {
+    let o = null;
+    try { o = JSON.parse(readFileSync(file, "utf8")); } catch { o = null; }
+    const holds = o && typeof o.holds === "object" && o.holds && !Array.isArray(o.holds) ? o.holds : {};
+    const t = now(), live = {};
+    for (const [id, h] of Object.entries(holds)) if (Number.isFinite(h?.until) && h.until > t) live[id] = h;
+    return live;
+  };
+  const write = (holds) => writeAtomic(file, JSON.stringify({ v: 1, holds }, null, 2) + "\n");
+  return {
+    file,
+    /** Epoch ms the account `id` is held until, or null. */
+    holdUntil: (id) => read()[id]?.until ?? null,
+    set: (id, untilMs, source = null) => {
+      const holds = read();
+      const prev = holds[id];
+      if (prev && prev.until >= untilMs) return prev.until;
+      holds[id] = { until: untilMs, source, setAt: now() };
+      write(holds);
+      return untilMs;
+    },
+    clear: (id) => {
+      const holds = read();
+      if (!holds[id]) return false;
+      delete holds[id];
+      write(holds);
+      return true;
+    },
+    clearAll: () => { const n = Object.keys(read()).length; write({}); return n; },
+    list: () => Object.entries(read()).map(([id, h]) => ({ id, until: h.until, source: h.source ?? null, setAt: h.setAt ?? null })),
+  };
+}

package/bin/lean/limits.test.mjs

@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { openLimits, laneBackendId, limitsFile } from "./limits.mjs";
+import { orchestrate } from "./orchestrate.mjs";
+import { limitsFromCli } from "../engine-cli.mjs";
+
+const fakeClock = () => { const c = { t: 1_000_000 }; return { c, now: () => c.t, sleep: async (ms) => { c.t += ms; } }; };
+const quiet = async (fn) => { const l = console.log; console.log = () => {}; try { return await fn(); } finally { console.log = l; } };
+const storeFile = () => join(tmpDir("limits-"), "limits.json");
+const limited = (id, until) => ({ terminalReason: "deferred", code: "rate_limited", resetAtEpochMs: until, backendId: id });
+
+describe("account-scoped usage-limit holds (#4190)", () => {
+  it("store: set keeps the later reset, expiry drops a hold, clear and clearAll remove holds", () => {
+    const { c, now } = fakeClock();
+    const file = storeFile();
+    const a = openLimits(file, { now });
+    assert.equal(a.holdUntil("A"), null);
+    a.set("A", c.t + 1000, "batch b1 #1");
+    a.set("A", c.t + 500, "batch b1 #2"); // an earlier reset never shortens the hold
+    assert.equal(a.holdUntil("A"), c.t + 1000);
+    assert.deepEqual(a.list().map((h) => [h.id, h.source]), [["A", "batch b1 #1"]]);
+    // a second handle on the same file (another batch) sees the hold
+    const b = openLimits(file, { now });
+    assert.equal(b.holdUntil("A"), c.t + 1000);
+    b.set("B", c.t + 5000, "batch b2 #9");
+    assert.equal(a.holdUntil("B"), c.t + 5000);
+    assert.equal(a.clear("B"), true);
+    assert.equal(a.clear("B"), false);
+    c.t += 1000; // expiry
+    assert.equal(a.holdUntil("A"), null);
+    a.set("C", c.t + 10, "x");
+    assert.deepEqual(Object.keys(JSON.parse(readFileSync(file, "utf8")).holds), ["C"], "expired holds are pruned on write");
+    assert.equal(a.clearAll(), 1);
+    assert.deepEqual(a.list(), []);
+  });
+
+  it("store: a missing or corrupt file reads as no holds", () => {
+    const file = storeFile();
+    assert.deepEqual(openLimits(file).list(), []);
+    writeFileSync(file, "{not json");
+    assert.equal(openLimits(file).holdUntil("A"), null);
+    openLimits(file).set("A", Date.now() + 60_000, "s");
+    assert.ok(openLimits(file).holdUntil("A") > Date.now());
+  });
+
+  it("identity follows the account (CLAUDE_CONFIG_DIR) and the store path honours FORGEDOCK_LIMITS_FILE", () => {
+    assert.notEqual(laneBackendId({ CLAUDE_CONFIG_DIR: "/acct/one" }), laneBackendId({ CLAUDE_CONFIG_DIR: "/acct/two" }));
+    assert.equal(laneBackendId({ CLAUDE_CONFIG_DIR: "/acct/one" }), laneBackendId({ CLAUDE_CONFIG_DIR: "/acct/one" }));
+    assert.equal(limitsFile({ FORGEDOCK_LIMITS_FILE: "/x/l.json" }), "/x/l.json");
+    assert.match(limitsFile({}), /\.forge[/\\]limits\.json$/);
+  });
+
+  it("a hold is tied to the account: after an account switch the limited issue and the rest run at once", async () => {
+    const { c, now, sleep } = fakeClock();
+    const t0 = c.t;
+    const limits = openLimits(storeFile(), { now });
+    let acct = "A";
+    const starts = {};
+    let heldAtRetry;
+    const rows = await orchestrate({ issues: [1, 2], parallel: 1, now, sleep, readBody: async () => "", limits, identity: () => acct, batchId: "b1",
+      runOne: async (n) => {
+        (starts[n] ??= []).push(now());
+        if (n === 1 && starts[1].length === 1) { acct = "B"; return limited("A", t0 + 600_000); } // the operator switches accounts
+        heldAtRetry ??= { A: limits.holdUntil("A"), B: limits.holdUntil("B"), source: limits.list()[0]?.source };
+        return { terminalReason: "merged" };
+      } });
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged", "merged"]);
+    assert.equal(starts[2][0], t0, "#2 runs on account B without waiting for A's reset");
+    assert.equal(starts[1][1], t0, "#1 is retried on account B at once");
+    assert.deepEqual(heldAtRetry, { A: t0 + 600_000, B: null, source: "batch b1 #1" }, "A stays held in the host store; B is not");
+  });
+
+  it("a hold on the same account still waits for the reset", async () => {
+    const { c, now, sleep } = fakeClock();
+    const t0 = c.t;
+    const limits = openLimits(storeFile(), { now });
+    const starts = [];
+    await orchestrate({ issues: [1], now, sleep, readBody: async () => "", limits, identity: () => "A",
+      runOne: async () => { starts.push(now()); return starts.length === 1 ? limited("A", t0 + 600_000) : { terminalReason: "merged" }; } });
+    assert.deepEqual(starts, [t0, t0 + 600_000]);
+  });
+
+  it("two batches on the same account share one hold; a batch on another account is not held", async () => {
+    // Each batch is its own dispatcher with its own clock and its own handle on the one host file.
+    const file = storeFile();
+    const k1 = fakeClock(), t0 = k1.c.t;
+    const b1 = [];
+    await orchestrate({ issues: [1], now: k1.now, sleep: k1.sleep, readBody: async () => "", limits: openLimits(file, { now: k1.now }), identity: () => "A", batchId: "b1",
+      runOne: async () => { b1.push(k1.now()); return b1.length === 1 ? limited("A", t0 + 600_000) : { terminalReason: "merged" }; } });
+    const k2 = fakeClock(), same = [];
+    await orchestrate({ issues: [7], now: k2.now, sleep: k2.sleep, readBody: async () => "", limits: openLimits(file, { now: k2.now }), identity: () => "A", batchId: "b2",
+      runOne: async () => { same.push(k2.now()); return { terminalReason: "merged" }; } });
+    assert.equal(same[0], t0 + 600_000, "batch 2 on account A waited for batch 1's hold");
+    const k3 = fakeClock(), other = [];
+    await orchestrate({ issues: [8], now: k3.now, sleep: k3.sleep, readBody: async () => "", limits: openLimits(file, { now: k3.now }), identity: () => "B", batchId: "b3",
+      runOne: async () => { other.push(k3.now()); return { terminalReason: "merged" }; } });
+    assert.equal(other[0], t0, "batch 3 on account B is not held");
+  });
+
+  it("clearing a hold lets a held batch admit on its next pass", async () => {
+    const { c, now } = fakeClock();
+    const t0 = c.t;
+    const limits = openLimits(storeFile(), { now });
+    limits.set("A", t0 + 3_600_000, "batch b0 #1");
+    const starts = [];
+    const sleep = async (ms) => { limits.clear("A"); c.t += Math.min(ms, 5000); };
+    await orchestrate({ issues: [1], now, sleep, readBody: async () => "", limits, identity: () => "A", getParallel: () => 1, pollMs: 5000,
+      runOne: async () => { starts.push(now()); return { terminalReason: "merged" }; } });
+    assert.equal(starts[0], t0 + 5000, "admitted on the poll after the clear, not at the hour-long reset");
+  });
+
+  it("a legacy batch-local holdUntil is ignored on resume and no longer persisted", async () => {
+    const { c, now, sleep } = fakeClock();
+    let state = { v: 1, order: [1], pending: [1], holdUntil: c.t + 3_600_000 };
+    const store = { load: () => state, save: (s) => { state = s; } };
+    const starts = [];
+    const rows = await orchestrate({ issues: [], now, sleep, readBody: async () => "", store, limits: openLimits(storeFile(), { now }), identity: () => "A",
+      runOne: async () => { starts.push(now()); return { terminalReason: "merged" }; } });
+    assert.equal(rows[0].outcome, "merged");
+    assert.equal(starts[0], 1_000_000);
+    assert.equal("holdUntil" in state, false);
+  });
+
+  it("forgedock limits show lists holds and marks this account; clear <id> and clear --all drop them", async () => {
+    const limits = openLimits(storeFile());
+    const until = Date.now() + 600_000;
+    limits.set("aaaa", until, "batch b1 #1");
+    limits.set("bbbb", until, "batch b2 #2");
+    const lines = [];
+    const l = console.log; console.log = (s) => lines.push(s);
+    let shown;
+    try { shown = await limitsFromCli(["show"], { limits, identity: () => "aaaa" }); } finally { console.log = l; }
+    assert.equal(shown.current, "aaaa");
+    assert.equal(shown.holds.length, 2);
+    assert.match(lines.join("\n"), new RegExp(`^\\* aaaa  until ${new Date(until).toISOString()}  source batch b1 #1$`, "m"));
+    assert.match(lines.join("\n"), /^ {2}bbbb .*source batch b2 #2$/m);
+    await quiet(() => limitsFromCli(["clear", "bbbb"], { limits, identity: () => "aaaa" }));
+    assert.equal(limits.holdUntil("bbbb"), null);
+    await assert.rejects(() => quiet(() => limitsFromCli(["clear", "bbbb"], { limits })), /no active usage-limit hold/);
+    await assert.rejects(() => quiet(() => limitsFromCli(["clear"], { limits })), /usage: forgedock limits/);
+    await assert.rejects(() => quiet(() => limitsFromCli(["nope"], { limits })), /usage: forgedock limits/);
+    assert.deepEqual(await quiet(() => limitsFromCli(["clear", "--all"], { limits })), { cleared: 1 });
+    assert.deepEqual(limits.list(), []);
+  });
+});