kodelyth-ecc 1.8.0 → 1.8.2

package/tests/supply-chain/manifest.test.js

@@ -1,147 +0,0 @@
-// Tests for scripts/supply-chain/manifest.js
-'use strict';
-
-const test   = require('node:test');
-const assert = require('node:assert/strict');
-const fs     = require('node:fs');
-const os     = require('node:os');
-const path   = require('node:path');
-const crypto = require('node:crypto');
-
-const M = require('../../scripts/supply-chain/manifest.js');
-
-function makeFakeRepo(layout) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-manifest-'));
-  for (const [rel, content] of Object.entries(layout)) {
-    const abs = path.join(dir, rel);
-    fs.mkdirSync(path.dirname(abs), { recursive: true });
-    const data = typeof content === 'string' ? content : JSON.stringify(content);
-    fs.writeFileSync(abs, data);
-  }
-  return dir;
-}
-function cleanup(dir) {
-  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* */ }
-}
-
-test('schema constants exposed', () => {
-  assert.equal(M.MANIFEST_SCHEMA, 'kodelyth.content-manifest/v1');
-  assert.equal(M.MANIFEST_VERSION, 1);
-});
-
-test('hashFile: sha256 of known content', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-h-'));
-  const f = path.join(dir, 'a.txt');
-  fs.writeFileSync(f, 'hello');
-  try {
-    const expected = crypto.createHash('sha256').update('hello').digest('hex');
-    assert.equal(M.hashFile(f), expected);
-  } finally { cleanup(dir); }
-});
-
-test('walkFiles: includes shipped root files when present', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'README.md':     '# fake',
-    'CHANGELOG.md':  '## 0.1.0',
-    'agents/a.md':   'agent a',
-    'skills/s/SKILL.md': '# skill s',
-  });
-  try {
-    const files = M.walkFiles(dir);
-    const rels = files.map(f => path.relative(dir, f).split(path.sep).join('/'));
-    assert.ok(rels.includes('package.json'));
-    assert.ok(rels.includes('README.md'));
-    assert.ok(rels.includes('CHANGELOG.md'));
-    assert.ok(rels.includes('agents/a.md'));
-    assert.ok(rels.includes('skills/s/SKILL.md'));
-  } finally { cleanup(dir); }
-});
-
-test('walkFiles: skips node_modules and .git', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'agents/a.md':   'a',
-    'agents/node_modules/x.js': 'should-skip',
-    'scripts/.git/HEAD': 'should-skip',
-  });
-  try {
-    const files = M.walkFiles(dir);
-    const rels = files.map(f => path.relative(dir, f).split(path.sep).join('/'));
-    assert.ok(rels.includes('agents/a.md'));
-    assert.ok(!rels.some(r => r.includes('node_modules')));
-    assert.ok(!rels.some(r => r.includes('.git')));
-  } finally { cleanup(dir); }
-});
-
-test('walkFiles: deterministic ordering', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'agents/z.md':   'z',
-    'agents/a.md':   'a',
-    'agents/m.md':   'm',
-  });
-  try {
-    const a = M.walkFiles(dir);
-    const b = M.walkFiles(dir);
-    assert.deepEqual(a, b);
-    // Sorted alphabetically by absolute path → relative path.
-    const rels = a.map(f => path.relative(dir, f));
-    const sorted = [...rels].sort();
-    assert.deepEqual(rels, sorted);
-  } finally { cleanup(dir); }
-});
-
-test('generateManifest: rejects missing rootDir', () => {
-  assert.throws(() => M.generateManifest({}), /rootDir is required/);
-});
-
-test('generateManifest: produces stable digest across runs', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'agents/a.md':   'agent a',
-  });
-  try {
-    const m1 = M.generateManifest({ rootDir: dir, timestamp: 'fixed' });
-    const m2 = M.generateManifest({ rootDir: dir, timestamp: 'fixed' });
-    assert.equal(m1.digest, m2.digest);
-    assert.deepEqual(m1.files, m2.files);
-  } finally { cleanup(dir); }
-});
-
-test('generateManifest: digest changes when content changes', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'agents/a.md':   'v1',
-  });
-  try {
-    const m1 = M.generateManifest({ rootDir: dir });
-    fs.writeFileSync(path.join(dir, 'agents/a.md'), 'v2');
-    const m2 = M.generateManifest({ rootDir: dir });
-    assert.notEqual(m1.digest, m2.digest);
-  } finally { cleanup(dir); }
-});
-
-test('generateManifest: every entry has path/size/sha256', () => {
-  const dir = makeFakeRepo({
-    'package.json':  { name: 'fake', version: '0.1.0' },
-    'agents/a.md':   'hello world',
-  });
-  try {
-    const m = M.generateManifest({ rootDir: dir });
-    assert.ok(m.files.length >= 2);
-    for (const f of m.files) {
-      assert.ok(typeof f.path === 'string');
-      assert.ok(typeof f.size === 'number');
-      assert.match(f.sha256, /^[0-9a-f]{64}$/);
-    }
-  } finally { cleanup(dir); }
-});
-
-test('generateManifest: real repo produces large manifest', () => {
-  const repoRoot = path.resolve(__dirname, '..', '..');
-  const m = M.generateManifest({ rootDir: repoRoot });
-  assert.equal(m.package, 'kodelyth-ecc');
-  assert.ok(m.file_count > 100, `expected many files, got ${m.file_count}`);
-  assert.match(m.digest, /^[0-9a-f]{64}$/);
-});

package/tests/supply-chain/sbom.test.js

@@ -1,170 +0,0 @@
-// Tests for scripts/supply-chain/sbom.js
-'use strict';
-
-const test   = require('node:test');
-const assert = require('node:assert/strict');
-const fs     = require('node:fs');
-const os     = require('node:os');
-const path   = require('node:path');
-
-const SBOM = require('../../scripts/supply-chain/sbom.js');
-const { generateSBOM, buildComponentFromLockEntry, _internals } = SBOM;
-
-// ── helpers: build a fake mini-package on disk ───────────────────────────────
-
-function makeFakePkg(layout) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-sbom-'));
-  for (const [rel, content] of Object.entries(layout)) {
-    const abs = path.join(dir, rel);
-    fs.mkdirSync(path.dirname(abs), { recursive: true });
-    fs.writeFileSync(abs, typeof content === 'string' ? content : JSON.stringify(content, null, 2));
-  }
-  return dir;
-}
-
-function cleanup(dir) {
-  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* */ }
-}
-
-// ── SBOM_FORMAT / SBOM_SPEC_VERSION ──────────────────────────────────────────
-
-test('SBOM constants exposed', () => {
-  assert.equal(SBOM.SBOM_FORMAT, 'CycloneDX');
-  assert.equal(SBOM.SBOM_SPEC_VERSION, '1.5');
-});
-
-// ── generateSBOM ─────────────────────────────────────────────────────────────
-
-test('generateSBOM: rejects missing rootDir', () => {
-  assert.throws(() => generateSBOM({}), /rootDir is required/);
-});
-
-test('generateSBOM: with no lockfile produces a valid root-only BOM', () => {
-  const dir = makeFakePkg({
-    'package.json': { name: 'fake-pkg', version: '0.1.0', license: 'MIT' },
-  });
-  try {
-    const bom = generateSBOM({ rootDir: dir, timestamp: '2026-05-10T17:00:00Z' });
-    assert.equal(bom.bomFormat, 'CycloneDX');
-    assert.equal(bom.specVersion, '1.5');
-    assert.equal(bom.metadata.component.name, 'fake-pkg');
-    assert.equal(bom.metadata.component.version, '0.1.0');
-    assert.equal(bom.metadata.component.purl, 'pkg:npm/fake-pkg@0.1.0');
-    assert.deepEqual(bom.components, []);
-    assert.deepEqual(bom.dependencies, []);
-    assert.equal(bom.metadata.timestamp, '2026-05-10T17:00:00Z');
-    assert.match(bom.serialNumber, /^urn:uuid:[0-9a-f-]+$/);
-  } finally { cleanup(dir); }
-});
-
-test('generateSBOM: with lockfile emits library components for each package', () => {
-  const dir = makeFakePkg({
-    'package.json': { name: 'fake-pkg', version: '0.1.0', dependencies: { foo: '^1.0.0' } },
-    'package-lock.json': {
-      name: 'fake-pkg',
-      version: '0.1.0',
-      lockfileVersion: 3,
-      packages: {
-        '': {
-          name: 'fake-pkg',
-          version: '0.1.0',
-          dependencies: { foo: '^1.0.0' },
-        },
-        'node_modules/foo': {
-          version: '1.2.3',
-          license: 'MIT',
-          integrity: 'sha512-' + Buffer.from('a'.repeat(64), 'hex').toString('base64'),
-        },
-        'node_modules/foo/node_modules/@scope/bar': {
-          version: '2.0.0',
-          license: 'Apache-2.0',
-        },
-      },
-    },
-  });
-  try {
-    const bom = generateSBOM({ rootDir: dir });
-    assert.equal(bom.components.length, 2);
-    const foo = bom.components.find(c => c.name === 'foo');
-    assert.ok(foo);
-    assert.equal(foo.version, '1.2.3');
-    assert.equal(foo.purl, 'pkg:npm/foo@1.2.3');
-    assert.equal(foo.scope, 'required');
-    assert.equal(foo.licenses[0].license.id, 'MIT');
-    assert.equal(foo.hashes[0].alg, 'SHA-512');
-
-    const scoped = bom.components.find(c => c.name === '@scope/bar');
-    assert.ok(scoped);
-    assert.equal(scoped.purl, 'pkg:npm/@scope/bar@2.0.0');
-
-    // Direct deps wired in dependencies graph.
-    assert.equal(bom.dependencies.length, 1);
-    assert.equal(bom.dependencies[0].ref, 'fake-pkg@0.1.0');
-    assert.deepEqual(bom.dependencies[0].dependsOn, ['foo@1.2.3']);
-  } finally { cleanup(dir); }
-});
-
-test('generateSBOM: dev dependencies marked as scope=optional', () => {
-  const dir = makeFakePkg({
-    'package.json': { name: 'fake-pkg', version: '0.1.0' },
-    'package-lock.json': {
-      lockfileVersion: 3,
-      packages: {
-        '': { name: 'fake-pkg', version: '0.1.0' },
-        'node_modules/dev-only': { version: '1.0.0', dev: true },
-      },
-    },
-  });
-  try {
-    const bom = generateSBOM({ rootDir: dir });
-    const c = bom.components.find(x => x.name === 'dev-only');
-    assert.equal(c.scope, 'optional');
-  } finally { cleanup(dir); }
-});
-
-test('generateSBOM: real repo lockfile produces parseable BOM', () => {
-  const repoRoot = path.resolve(__dirname, '..', '..');
-  const bom = generateSBOM({ rootDir: repoRoot });
-  assert.equal(bom.metadata.component.name, 'kodelyth-ecc');
-  assert.ok(bom.components.length > 0, 'should have at least one component from real lockfile');
-  // Every component must have a purl.
-  for (const c of bom.components.slice(0, 10)) {
-    assert.match(c.purl, /^pkg:npm\//);
-  }
-});
-
-// ── helpers ──────────────────────────────────────────────────────────────────
-
-test('buildComponentFromLockEntry: skips entries without name+version', () => {
-  assert.equal(buildComponentFromLockEntry('node_modules/x', {}), null);
-});
-
-test('_internals.npmPurl: scoped packages keep slash', () => {
-  assert.equal(_internals.npmPurl('@scope/x', '1.0.0'), 'pkg:npm/@scope/x@1.0.0');
-});
-
-test('_internals.parseIntegrity: handles sha512 base64', () => {
-  const sri = 'sha512-' + Buffer.from('a'.repeat(64), 'hex').toString('base64');
-  const out = _internals.parseIntegrity(sri);
-  assert.equal(out[0].alg, 'SHA-512');
-  assert.match(out[0].content, /^[0-9a-f]+$/);
-});
-
-test('_internals.parseIntegrity: skips unknown algorithms', () => {
-  const out = _internals.parseIntegrity('md5-AAAA');
-  assert.deepEqual(out, []);
-});
-
-test('_internals.deriveSerial: stable for same inputs', () => {
-  const a = _internals.deriveSerial({ name: 'x', version: '1.0.0' }, '2026-05-10T00:00:00Z');
-  const b = _internals.deriveSerial({ name: 'x', version: '1.0.0' }, '2026-05-10T00:00:00Z');
-  assert.equal(a, b);
-  assert.match(a, /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
-});
-
-test('_internals.pkgNameFromPath: deepest scoped path wins', () => {
-  assert.equal(
-    _internals.pkgNameFromPath('node_modules/foo/node_modules/@scope/bar'),
-    '@scope/bar'
-  );
-});

package/tests/supply-chain/verify.test.js

@@ -1,146 +0,0 @@
-// Tests for scripts/supply-chain/verify.js
-'use strict';
-
-const test   = require('node:test');
-const assert = require('node:assert/strict');
-const fs     = require('node:fs');
-const os     = require('node:os');
-const path   = require('node:path');
-
-const M = require('../../scripts/supply-chain/manifest.js');
-const V = require('../../scripts/supply-chain/verify.js');
-
-function makeFakeRepo(layout) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-verify-'));
-  for (const [rel, content] of Object.entries(layout)) {
-    const abs = path.join(dir, rel);
-    fs.mkdirSync(path.dirname(abs), { recursive: true });
-    fs.writeFileSync(abs, typeof content === 'string' ? content : JSON.stringify(content));
-  }
-  return dir;
-}
-function cleanup(dir) { try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* */ } }
-
-const FAKE_LAYOUT = {
-  'package.json': { name: 'fake', version: '0.1.0' },
-  'agents/a.md':  'agent a v1',
-  'skills/s/SKILL.md': '# s',
-};
-
-// ── argument validation ──────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: rejects missing rootDir', () => {
-  assert.throws(() => V.verifyAgainstManifest({ manifest: { schema: M.MANIFEST_SCHEMA, files: [] } }),
-    /rootDir is required/);
-});
-
-test('verifyAgainstManifest: rejects missing manifest', () => {
-  assert.throws(() => V.verifyAgainstManifest({ rootDir: '/tmp' }), /manifest is required/);
-});
-
-test('verifyAgainstManifest: rejects unsupported manifest schema', () => {
-  assert.throws(
-    () => V.verifyAgainstManifest({ rootDir: '/tmp', manifest: { schema: 'wrong', files: [] } }),
-    /unsupported manifest schema/
-  );
-});
-
-// ── happy path ───────────────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: clean repo returns ok=true with all files', () => {
-  const dir = makeFakeRepo(FAKE_LAYOUT);
-  try {
-    const manifest = M.generateManifest({ rootDir: dir });
-    const r = V.verifyAgainstManifest({ rootDir: dir, manifest });
-    assert.equal(r.ok, true);
-    assert.equal(r.summary.modified, 0);
-    assert.equal(r.summary.missing, 0);
-    assert.equal(r.summary.extra, 0);
-    assert.equal(r.summary.ok, manifest.file_count);
-  } finally { cleanup(dir); }
-});
-
-// ── modified file ────────────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: detects modified file with sha mismatch', () => {
-  const dir = makeFakeRepo(FAKE_LAYOUT);
-  try {
-    const manifest = M.generateManifest({ rootDir: dir });
-    fs.writeFileSync(path.join(dir, 'agents/a.md'), 'agent a v2');
-    const r = V.verifyAgainstManifest({ rootDir: dir, manifest });
-    assert.equal(r.ok, false);
-    assert.equal(r.summary.modified, 1);
-    assert.equal(r.details.modified[0].path, 'agents/a.md');
-    assert.match(r.details.modified[0].expected_sha256, /^[0-9a-f]{64}$/);
-    assert.match(r.details.modified[0].actual_sha256, /^[0-9a-f]{64}$/);
-    assert.notEqual(
-      r.details.modified[0].expected_sha256,
-      r.details.modified[0].actual_sha256
-    );
-  } finally { cleanup(dir); }
-});
-
-// ── missing file ─────────────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: detects missing file', () => {
-  const dir = makeFakeRepo(FAKE_LAYOUT);
-  try {
-    const manifest = M.generateManifest({ rootDir: dir });
-    fs.unlinkSync(path.join(dir, 'agents/a.md'));
-    const r = V.verifyAgainstManifest({ rootDir: dir, manifest });
-    assert.equal(r.ok, false);
-    assert.equal(r.summary.missing, 1);
-    assert.equal(r.details.missing[0].path, 'agents/a.md');
-  } finally { cleanup(dir); }
-});
-
-// ── extra file ───────────────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: extra files reported but do not fail verify', () => {
-  const dir = makeFakeRepo(FAKE_LAYOUT);
-  try {
-    const manifest = M.generateManifest({ rootDir: dir });
-    fs.writeFileSync(path.join(dir, 'agents/extra.md'), 'unexpected');
-    const r = V.verifyAgainstManifest({ rootDir: dir, manifest });
-    assert.equal(r.ok, true, 'extras alone should not fail verify');
-    assert.equal(r.summary.extra, 1);
-    assert.ok(r.details.extra.includes('agents/extra.md'));
-  } finally { cleanup(dir); }
-});
-
-// ── combined ─────────────────────────────────────────────────────────────────
-
-test('verifyAgainstManifest: counts modified, missing, extra independently', () => {
-  const dir = makeFakeRepo(FAKE_LAYOUT);
-  try {
-    const manifest = M.generateManifest({ rootDir: dir });
-    fs.writeFileSync(path.join(dir, 'agents/a.md'), 'tampered');
-    fs.unlinkSync(path.join(dir, 'skills/s/SKILL.md'));
-    fs.writeFileSync(path.join(dir, 'agents/new.md'), 'fresh');
-    const r = V.verifyAgainstManifest({ rootDir: dir, manifest });
-    assert.equal(r.ok, false);
-    assert.equal(r.summary.modified, 1);
-    assert.equal(r.summary.missing, 1);
-    assert.equal(r.summary.extra, 1);
-  } finally { cleanup(dir); }
-});
-
-// ── round-trip integration ───────────────────────────────────────────────────
-
-test('verifyAgainstManifest: round-trips clean across copy', () => {
-  const dir1 = makeFakeRepo(FAKE_LAYOUT);
-  const dir2 = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-verify-2-'));
-  try {
-    // Copy files to dir2.
-    for (const f of M.walkFiles(dir1)) {
-      const rel = path.relative(dir1, f);
-      const dest = path.join(dir2, rel);
-      fs.mkdirSync(path.dirname(dest), { recursive: true });
-      fs.copyFileSync(f, dest);
-    }
-    const manifest = M.generateManifest({ rootDir: dir1 });
-    const r = V.verifyAgainstManifest({ rootDir: dir2, manifest });
-    assert.equal(r.ok, true);
-    assert.equal(r.summary.ok, manifest.file_count);
-  } finally { cleanup(dir1); cleanup(dir2); }
-});

package/tests/swarm/build-plan.test.js

@@ -1,188 +0,0 @@
-// Tests for scripts/swarm/build-plan.js — pure builder, no tmux/git side effects.
-'use strict';
-
-const test   = require('node:test');
-const assert = require('node:assert/strict');
-const path   = require('path');
-
-const B = require('../../scripts/swarm/build-plan');
-const O = require('../../scripts/lib/tmux-worktree-orchestrator.js');
-
-// ── pickAgents ───────────────────────────────────────────────────────────────
-
-test('pickAgents: explicit list wins over count + signals', () => {
-  const picked = B.pickAgents({
-    count: 4,
-    task:  'security audit oauth flow',
-    explicit: ['code-architect', 'release-captain'],
-  });
-  assert.deepEqual(picked, ['code-architect', 'release-captain']);
-});
-
-test('pickAgents: signal-driven for security task', () => {
-  const picked = B.pickAgents({ count: 4, task: 'security audit oauth flow for OWASP top 10' });
-  assert.ok(picked.includes('security-reviewer'), `expected security-reviewer in ${picked}`);
-});
-
-test('pickAgents: signal-driven for performance task', () => {
-  const picked = B.pickAgents({ count: 4, task: 'investigate p99 latency spike on the payments API' });
-  assert.ok(picked.includes('performance-optimizer'));
-  assert.ok(picked.includes('api-guardian'));
-});
-
-test('pickAgents: signal-driven for incident task picks incident-commander + debug-detective', () => {
-  const picked = B.pickAgents({ count: 4, task: 'production is down, P0 incident, why is auth service failing' });
-  assert.ok(picked.includes('incident-commander'));
-  assert.ok(picked.includes('debug-detective'));
-});
-
-test('pickAgents: includes baseline anchors when room remains', () => {
-  const picked = B.pickAgents({ count: 4, task: 'investigate p99 latency on payments API' });
-  // After signals (perf, api), should fill with code-reviewer + pair-programmer.
-  assert.ok(picked.includes('code-reviewer') || picked.includes('pair-programmer'));
-  assert.equal(picked.length, 4);
-});
-
-test('pickAgents: count clamped to upper bound 12 even with many signals', () => {
-  // A task with many signals so the picker has plenty of candidates.
-  const richTask = 'security audit with perf load-test architecture API tests refactor docs release incident debug database';
-  const picked = B.pickAgents({ count: 99, task: richTask });
-  assert.ok(picked.length <= 12, `expected ≤12, got ${picked.length}`);
-  assert.ok(picked.length > 8,  `expected >8 with rich signals, got ${picked.length}`);
-});
-
-test('pickAgents: count clamps to available pool when signals empty', () => {
-  // No matching signals + no signal agent rotation past 8 = bounded by pool size.
-  const picked = B.pickAgents({ count: 99, task: 'any' });
-  assert.ok(picked.length >= 8 && picked.length <= 12);
-});
-
-test('pickAgents: count of 1 produces 1 agent', () => {
-  assert.equal(B.pickAgents({ count: 1, task: 'any' }).length, 1);
-});
-
-test('pickAgents: falsy count falls back to default of 4', () => {
-  assert.equal(B.pickAgents({ count: 0,         task: 'any' }).length, 4);
-  assert.equal(B.pickAgents({ count: undefined, task: 'any' }).length, 4);
-});
-
-test('pickAgents: deduplicates if signal + anchor + rotation overlap', () => {
-  const picked = B.pickAgents({ count: 6, task: 'do a code review of payment refactor with security implications' });
-  assert.equal(new Set(picked).size, picked.length, 'no duplicate agents');
-});
-
-// ── shapeTaskForAgent ────────────────────────────────────────────────────────
-
-test('shapeTaskForAgent: includes agent name + required sections', () => {
-  const out = B.shapeTaskForAgent('security-reviewer', 'audit oauth flow');
-  assert.match(out, /# security-reviewer — swarm task/);
-  assert.match(out, /audit oauth flow/);
-  assert.match(out, /## Required handoff sections/);
-  assert.match(out, /1\. Summary/);
-  assert.match(out, /2\. Files Changed/);
-  assert.match(out, /3\. Validation/);
-  assert.match(out, /4\. Remaining Risks/);
-});
-
-test('shapeTaskForAgent: handles empty task gracefully', () => {
-  const out = B.shapeTaskForAgent('code-reviewer', '');
-  assert.match(out, /no task description provided/);
-});
-
-// ── buildWorker ──────────────────────────────────────────────────────────────
-
-test('buildWorker: claude harness produces a launcher with task placeholder', () => {
-  const w = B.buildWorker({ agent: 'security-reviewer', task: 'foo', harness: 'claude' });
-  assert.equal(w.name, 'security-reviewer');
-  assert.match(w.launcherCommand, /\{task_file_sh\}/);
-  assert.match(w.launcherCommand, /claude/);
-});
-
-test('buildWorker: codex harness uses orchestrate-codex-worker.sh', () => {
-  const w = B.buildWorker({ agent: 'security-reviewer', task: 'foo', harness: 'codex' });
-  assert.match(w.launcherCommand, /orchestrate-codex-worker\.sh/);
-});
-
-test('buildWorker: unknown harness throws helpful error', () => {
-  assert.throws(
-    () => B.buildWorker({ agent: 'x', task: 'y', harness: 'bogus' }),
-    /No launcher template for harness "bogus"/
-  );
-});
-
-test('buildWorker: custom launcherCommand overrides harness', () => {
-  const w = B.buildWorker({ agent: 'x', task: 'y', harness: 'claude', launcherCommand: 'my-custom {task_file}' });
-  assert.equal(w.launcherCommand, 'my-custom {task_file}');
-});
-
-// ── buildSwarmPlan (full plan-config) ────────────────────────────────────────
-
-test('buildSwarmPlan: rejects empty task', () => {
-  assert.throws(() => B.buildSwarmPlan({ task: '' }), /--task is required/);
-  assert.throws(() => B.buildSwarmPlan({}),            /--task is required/);
-});
-
-test('buildSwarmPlan: produces a plan-config the orchestrator can consume', () => {
-  const planConfig = B.buildSwarmPlan({
-    task:    'audit oauth flow for security',
-    count:   4,
-    harness: 'echo',
-    repoRoot: process.cwd(),
-  });
-  assert.ok(planConfig.workers.length === 4);
-  assert.ok(planConfig.sessionName.startsWith('swarm-'));
-  assert.ok(planConfig._meta.pickedAgents.includes('security-reviewer'));
-
-  // Verify orchestrator accepts it without throwing.
-  const plan = O.buildOrchestrationPlan(planConfig);
-  assert.equal(plan.workerPlans.length, 4);
-  assert.ok(plan.workerPlans.every(w => w.launchCommand.includes('demo')));
-  assert.ok(plan.workerPlans.every(w => w.taskFilePath.includes('.orchestration')));
-});
-
-test('buildSwarmPlan: explicit agents preserved in worker order', () => {
-  const planConfig = B.buildSwarmPlan({
-    task:    'ship v2.0',
-    agents:  ['release-captain', 'security-reviewer', 'e2e-runner'],
-    harness: 'echo',
-  });
-  assert.deepEqual(
-    planConfig.workers.map(w => w.name),
-    ['release-captain', 'security-reviewer', 'e2e-runner']
-  );
-});
-
-test('buildSwarmPlan: passes through orchestrator-only fields', () => {
-  const planConfig = B.buildSwarmPlan({
-    task:             'test',
-    count:            2,
-    harness:          'echo',
-    sessionName:      'my-custom-session',
-    baseRef:          'main',
-    replaceExisting:  true,
-    seedPaths:        ['scripts'],
-    coordinationRoot: '/tmp/coord',
-    worktreeRoot:     '/tmp/worktrees',
-  });
-  assert.equal(planConfig.sessionName,      'my-custom-session');
-  assert.equal(planConfig.baseRef,          'main');
-  assert.equal(planConfig.replaceExisting,  true);
-  assert.deepEqual(planConfig.seedPaths,    ['scripts']);
-  assert.equal(planConfig.coordinationRoot, '/tmp/coord');
-  assert.equal(planConfig.worktreeRoot,     '/tmp/worktrees');
-});
-
-test('buildSwarmPlan + orchestrator: worker tasks contain agent-shaped prompt', () => {
-  const planConfig = B.buildSwarmPlan({
-    task:    'audit oauth flow',
-    count:   2,
-    harness: 'echo',
-    agents:  ['security-reviewer', 'code-reviewer'],
-  });
-  const plan = O.buildOrchestrationPlan(planConfig);
-  for (const w of plan.workerPlans) {
-    assert.match(w.task, /Required handoff sections/);
-    assert.match(w.task, /audit oauth flow/);
-    assert.match(w.task, new RegExp(w.workerName));
-  }
-});