pi-harness-runtime 1.1.439 → 1.1.441

package/harness/langchain/widget.test.ts

@@ -1,251 +0,0 @@
-/**
- * LoopWidget tests — T14
- *
- * Run:
- *   bun test harness/langchain/widget.test.ts
- */
-
-import { describe, it, beforeEach } from "node:test";
-import assert from "node:assert";
-import { LoopWidget } from "./widget.js";
-
-// ─── Fixtures ────────────────────────────────────────────────────────────────
-
-const stubTheme = {
-	fg: (color: string, s: string): string => {
-		const codes: Record<string, string> = {
-			dim: `\x1b[2m${s}\x1b[0m`,
-			error: `\x1b[31m${s}\x1b[0m`,
-			warning: `\x1b[33m${s}\x1b[0m`,
-			success: `\x1b[32m${s}\x1b[0m`,
-			accent: `\x1b[36m${s}\x1b[0m`,
-		};
-		return codes[color] ?? s;
-	},
-};
-
-describe("T14 — LoopWidget", () => {
-	let widget: LoopWidget;
-
-	beforeEach(() => {
-		widget = new LoopWidget();
-	});
-
-	// ─── Idle state ────────────────────────────────────────────────────────
-
-	it("starts in idle phase", () => {
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /idle/);
-		assert.match(lines[0], /harness/);
-	});
-
-	// ─── Phase transitions ──────────────────────────────────────────────────
-
-	it("setPhase changes the phase label", () => {
-		widget.setPhase("writing");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /coding/);
-	});
-
-	it("setPhase with custom label uses the label", () => {
-		widget.setPhase("planning", "GPT planning");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /GPT planning/);
-	});
-
-	it("surge-pause shows detail line", () => {
-		widget.setSurgePause(new Date(Date.now() + 30 * 60_000)); // 30 min
-		const lines = widget.renderWidget(80, stubTheme);
-		// Label is "surge (in 30m)"
-		assert.ok(lines.some((l) => l.includes("surge") && l.includes("in 30m")));
-	});
-
-	it("setError shows error detail", () => {
-		widget.setError("model timeout");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("error")));
-		assert.ok(lines.some((l) => l.includes("model timeout")));
-	});
-
-	it("setComplete approved shows ✓ loop complete", () => {
-		widget.setComplete("approved");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /loop complete/);
-	});
-
-	it("setComplete rejected shows ✗ loop rejected", () => {
-		widget.setComplete("rejected");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /loop rejected/);
-	});
-
-	it("setComplete max_iterations shows iteration count", () => {
-		widget.setComplete("max_iterations");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /max iterations/);
-	});
-
-	// ─── Iteration tracking ────────────────────────────────────────────────
-
-	it("startIteration sets iteration and max", () => {
-		widget.startIteration(3, 5);
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /iter 3\/5/);
-	});
-
-	it("startIteration resets per-file counters but keeps file records", () => {
-		widget.recordWrite("src/a.ts");
-		widget.recordBlockers("src/a.ts", 2);
-		widget.startIteration(2, 5);
-		// Files accumulate across iterations (same codebase); only counters reset.
-		// After reset, a.ts shows with 0 write steps and 0 blockers.
-		const lines = widget.renderWidget(80, stubTheme);
-		const fileLines = lines.filter((l) => l.includes("a.ts"));
-		assert.ok(fileLines.length > 0, "file should still appear");
-		// No blocker count in the file row (reset to 0)
-		assert.ok(
-			!fileLines.some((l) => l.includes("!2")),
-			"blocker count should be reset",
-		);
-	});
-
-	// ─── File record tracking ──────────────────────────────────────────────
-
-	it("recordWrite shows file in widget", () => {
-		widget.recordWrite("src/foo.ts");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("foo.ts")));
-	});
-
-	it("recordWrite accumulates across calls", () => {
-		widget.recordWrite("src/bar.ts");
-		widget.recordWrite("src/bar.ts");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("bar.ts") && l.includes("✍2")));
-	});
-
-	it("recordBlockers shows blocker count", () => {
-		widget.recordBlockers("src/bad.ts", 2);
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("bad.ts") && l.includes("!2")));
-	});
-
-	it("recordReviewPass clears blockers and increments passes", () => {
-		widget.recordBlockers("src/ok.ts", 1);
-		widget.recordReviewPass("src/ok.ts");
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("ok.ts") && l.includes("🔍1")));
-		// No blocker count
-		assert.ok(
-			!lines.some(
-				(l) => l.includes("ok.ts") && l.includes("!") && !l.includes("🔍"),
-			),
-		);
-	});
-
-	// ─── Summary counts ────────────────────────────────────────────────────
-
-	it("no errors/warnings shows ✓", () => {
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines[0].includes("✓") || lines[0].includes("harness"));
-	});
-
-	it("errors shown as ●NE", () => {
-		widget.recordBlockers("src/err.ts", 3);
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.ok(lines.some((l) => l.includes("●3E")));
-	});
-
-	// ─── Surge pause ──────────────────────────────────────────────────────
-
-	it("setSurgePause shows reset time in minutes/hours", () => {
-		const resetAt = new Date(Date.now() + 90 * 60_000); // 90 minutes → "in 1h 30m"
-		widget.setSurgePause(resetAt);
-		const lines = widget.renderWidget(80, stubTheme);
-		const surgeLine = lines.find((l) => l.includes("surge"));
-		assert.ok(surgeLine !== undefined);
-		assert.match(surgeLine, /\(in \d+h/); // "in 1h 30m" matches
-	});
-
-	it("setSurgePause shows 'now' for past dates", () => {
-		const resetAt = new Date(Date.now() - 1000);
-		widget.setSurgePause(resetAt);
-		const lines = widget.renderWidget(80, stubTheme);
-		// Label format: "surge (now)"
-		assert.ok(lines.some((l) => l.includes("surge") && l.includes("(now)")));
-	});
-
-	// ─── Console fallback ─────────────────────────────────────────────────
-
-	it("toConsoleString returns human-readable output", () => {
-		widget.startIteration(2, 5);
-		widget.setPhase("writing", "coding");
-		widget.recordWrite("src/test.ts");
-		const output = widget.toConsoleString();
-		assert.match(output, /harness/);
-		assert.match(output, /iter 2\/5/);
-		assert.match(output, /coding/);
-		assert.match(output, /test\.ts/);
-	});
-
-	// ─── Width / truncation ───────────────────────────────────────────────
-
-	it("truncates long file names with …", () => {
-		widget.recordWrite(
-			"/very/long/path/to/a/very/long/file/name/that/exceeds/width.ts",
-		);
-		const lines = widget.renderWidget(40, stubTheme);
-		for (const line of lines) {
-			const stripped = line.replace(/\x1b\[[0-9;]*m/g, "");
-			assert.ok(stripped.length <= 41, `line too long: ${stripped}`);
-		}
-	});
-
-	// ─── reset() ─────────────────────────────────────────────────────────
-
-	it("reset() clears all state", () => {
-		widget.startIteration(2, 5);
-		widget.setPhase("writing");
-		widget.recordWrite("src/a.ts");
-		widget.reset();
-		const lines = widget.renderWidget(80, stubTheme);
-		assert.match(lines[0], /idle/);
-		assert.ok(!lines.some((l) => l.includes("a.ts")));
-	});
-
-	// ─── makeRenderer ─────────────────────────────────────────────────────
-
-	it("makeRenderer returns factory and invalidate", () => {
-		const { factory, invalidate } = widget.makeRenderer();
-		assert.equal(typeof factory, "function");
-		assert.equal(typeof invalidate, "function");
-	});
-
-	it("factory returns render + invalidate + dispose", () => {
-		const { factory } = widget.makeRenderer();
-		const comp = factory({} as any, stubTheme as any);
-		assert.equal(typeof comp.render, "function");
-		assert.equal(typeof comp.invalidate, "function");
-		assert.equal(typeof comp.dispose, "function");
-	});
-
-	it("factory render() returns widget lines", () => {
-		widget.setPhase("planning");
-		const { factory } = widget.makeRenderer();
-		const comp = factory({} as any, stubTheme as any);
-		const lines = comp.render(80);
-		assert.ok(Array.isArray(lines));
-		assert.ok(lines.length > 0);
-	});
-
-	// ─── getLoopWidget singleton ────────────────────────────────────────────
-
-	it("getLoopWidget returns the same instance", () => {
-		// Dynamic import to avoid module caching issues
-		import("./widget.js").then((m) => {
-			const a = m.getLoopWidget();
-			const b = m.getLoopWidget();
-			assert.strictEqual(a, b);
-		});
-	});
-});

package/harness/skill-sync.test.ts

@@ -1,57 +0,0 @@
-/**
- * Skill Sync Tests
- */
-
-// @ts-ignore - bun:test types
-import { describe, test, expect, beforeEach, afterEach } from "bun:test";
-import { tmpdir } from "node:os";
-import { mkdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
-
-// Mock the environment
-const originalApiKey = process.env.SKILLS_SAAS_API_KEY;
-
-describe("Skill Sync", () => {
-	let tempCacheDir: string;
-
-	beforeEach(() => {
-		tempCacheDir = join(tmpdir(), `skill-sync-test-${Date.now()}`);
-		mkdirSync(tempCacheDir, { recursive: true });
-	});
-
-	afterEach(() => {
-		// Restore env
-		if (originalApiKey === undefined) {
-			delete process.env.SKILLS_SAAS_API_KEY;
-		} else {
-			process.env.SKILLS_SAAS_API_KEY = originalApiKey;
-		}
-		// Cleanup
-		try {
-			rmSync(tempCacheDir, { recursive: true });
-		} catch {
-			// Ignore
-		}
-	});
-
-	describe("isSkillSyncConfigured", () => {
-		test("returns false when API key not set", () => {
-			delete process.env.SKILLS_SAAS_API_KEY;
-			// Import dynamically to test
-			expect(process.env.SKILLS_SAAS_API_KEY).toBeUndefined();
-		});
-
-		test("returns true when API key is set", () => {
-			process.env.SKILLS_SAAS_API_KEY = "sk_test_xxx";
-			expect(process.env.SKILLS_SAAS_API_KEY).toBe("sk_test_xxx");
-		});
-	});
-
-	describe("getSyncStatus", () => {
-		test("returns correct status when not configured", () => {
-			delete process.env.SKILLS_SAAS_API_KEY;
-			// Status should show not configured
-			expect(process.env.SKILLS_SAAS_API_KEY).toBeUndefined();
-		});
-	});
-});

package/harness/ssh-detach-interceptor.test.ts

@@ -1,263 +0,0 @@
-/**
- * SSH Detach Interceptor — Tests
- *
- * Key insight on quoting:
- * - `ssh user@host 'cmd &'` — & is INSIDE quotes → safe, SSH completes normally
- * - `ssh user@host "cmd" &` — & is OUTSIDE quotes → risky, backgrounds SSH itself
- * - `ssh user@host 'kill ... &' "2>/dev/null"` — & inside quotes, redirect outside → risky
- */
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import {
-	isSshCommand,
-	isDetachedPattern,
-	hasBareAmpersand,
-	transformToDetached,
-	detectSsh,
-	isForegroundDaemonSsh,
-	addSshTimeoutGuard,
-	getDefaultSshTimeoutSeconds,
-} from "./ssh-detach-interceptor.js";
-
-describe("isSshCommand", () => {
-	const cases: Array<[string, boolean]> = [
-		["ssh user@host ls", true],
-		["ssh -o StrictHostKeyChecking=no user@host ls", true],
-		["echo 'pass' | ssh user@host ls", true],
-		["curl https://example.com", false],
-		["cd /home && ls", false],
-		["ssh user@host 'echo test &'", true],
-		["docker exec container ls", false],
-	];
-	cases.forEach(([cmd, expected]) => {
-		it(`${cmd.slice(0, 50)} → ${expected}`, () => {
-			assert.strictEqual(isSshCommand(cmd), expected);
-		});
-	});
-});
-
-describe("isDetachedPattern", () => {
-	const cases: Array<[string, boolean]> = [
-		// & is inside quotes → not detached (no nohup locally visible)
-		["ssh user@host 'cmd > /tmp/log 2>&1 & echo DONE'", false],
-		// bare & inside quotes → not detached
-		["ssh user@host 'cmd &'", false],
-		// nohup + redirect + echo DONE → detached
-		["ssh user@host 'nohup cmd > /tmp/log 2>&1 & echo DONE'", true],
-		// missing echo DONE → not detached
-		["ssh user@host 'cmd > /tmp/log &'", false],
-		// missing redirect → not detached
-		["ssh user@host 'nohup cmd &'", false],
-		// non-SSH → not detached
-		["curl https://example.com", false],
-	];
-	cases.forEach(([cmd, expected]) => {
-		it(`${cmd.slice(0, 55)} → ${expected}`, () => {
-			assert.strictEqual(isDetachedPattern(cmd), expected);
-		});
-	});
-});
-
-describe("hasBareAmpersand", () => {
-	// & outside quotes = risky (backgrounds SSH itself)
-	const risky: Array<[string, boolean]> = [
-		["ssh user@host 'cmd' &", true],
-		["ssh user@host 'kill 123' &", true],
-		["echo 'pass' | ssh user@host 'kill 123' &", true],
-		["ssh user@host 'cmd > /tmp/log 2>&1' &", true],
-	];
-	// & inside quotes = safe (SSH completes, remote side backgrounds)
-	const safe: Array<[string, boolean]> = [
-		["ssh user@host 'cmd &'", false],
-		["ssh user@host 'kill -9 123 && uvicorn &'", false],
-		["ssh user@host 'nohup cmd &'", false],
-		["ssh user@host 'cmd'", false],
-		["curl https://example.com", false],
-	];
-	[...risky, ...safe].forEach(([cmd, expected]) => {
-		it(`${cmd.slice(0, 50)} → ${expected}`, () => {
-			assert.strictEqual(hasBareAmpersand(cmd), expected);
-		});
-	});
-});
-
-describe("transformToDetached", () => {
-	it("leaves non-SSH commands unchanged", () => {
-		const cmd = "curl https://example.com";
-		assert.strictEqual(transformToDetached(cmd), cmd);
-	});
-
-	it("leaves already-detached SSH commands unchanged", () => {
-		const cmd = "ssh user@host 'cmd > /tmp/log 2>&1 & echo DONE'";
-		assert.strictEqual(transformToDetached(cmd), cmd);
-	});
-
-	it("transforms bare ssh 'cmd' & (risky: & outside quotes)", () => {
-		const cmd = "ssh user@host 'kill -9 123; sleep 2; uvicorn' &";
-		const result = transformToDetached(cmd);
-		assert.notStrictEqual(result, cmd);
-		assert.ok(result.includes("nohup"), "should add nohup");
-		assert.ok(result.includes("/tmp/herdr-ssh.log"), "should add log redirect");
-		assert.ok(result.includes("2>&1"), "should add stderr redirect");
-		assert.ok(result.includes("echo 'SSH_DETACHED'"), "should add DONE echo");
-	});
-
-	it("transforms pipelined ssh with bare & (risky: & outside quotes)", () => {
-		const cmd = "echo 'pass' | ssh user@host 'kill -9 123' &";
-		const result = transformToDetached(cmd);
-		assert.notStrictEqual(result, cmd);
-		assert.ok(result.includes("nohup"));
-		assert.ok(result.includes("echo 'SSH_DETACHED'"));
-	});
-
-	it("leaves & inside quotes unchanged (safe: SSH completes)", () => {
-		const cmd = "ssh user@host 'kill -9 123; uvicorn &'";
-		const result = transformToDetached(cmd);
-		assert.strictEqual(result, cmd); // no transform needed
-	});
-
-	it("uses custom log file", () => {
-		const cmd = "ssh user@host 'cmd' &";
-		const result = transformToDetached(cmd, { logFile: "/var/log/my-ssh.log" });
-		assert.ok(result.includes("/var/log/my-ssh.log"));
-	});
-});
-
-describe("detectSsh", () => {
-	it("warns on SSH with bare & outside quotes", () => {
-		const result = detectSsh("ssh user@host 'cmd' &");
-		assert.strictEqual(result.isSsh, true);
-		assert.strictEqual(result.hasBareAmpersand, true);
-		assert.strictEqual(result.isDetached, false);
-		assert.ok(result.suggestion.includes("nohup"));
-	});
-
-	it("no warning for & inside quotes (SSH completes normally)", () => {
-		const result = detectSsh("ssh user@host 'kill 123 && uvicorn &'");
-		assert.strictEqual(result.isSsh, true);
-		assert.strictEqual(result.isDetached, false);
-		assert.strictEqual(result.hasBareAmpersand, false);
-		assert.strictEqual(result.suggestion, "");
-	});
-
-	it("no detection for non-SSH", () => {
-		const result = detectSsh("curl https://example.com");
-		assert.strictEqual(result.isSsh, false);
-		assert.strictEqual(result.suggestion, "");
-	});
-});
-
-describe("isForegroundDaemonSsh", () => {
-	// A synthetic stand-in for the foreground SSH command that used to hang
-	const HANG_CMD =
-		"echo 'synthetic-test-password' | ssh -tt worker@worker.example.com \"cd /srv/app/backend/services/worker && AMOS_API_URL=https://api.example.com AMOS_WORKER_API_KEY=test /srv/app/backend/.venv/bin/python -m amos_worker --video 2>&1 | head -10\"";
-
-	const risky: Array<[string, string]> = [
-		[
-			HANG_CMD,
-			"foreground ssh -tt running amos_worker poller",
-		],
-		[
-			'ssh host "uvicorn main:app --host 0.0.0.0 --port 8100"',
-			"foreground uvicorn",
-		],
-		["ssh host 'python -m celery worker'", "celery worker"],
-		['ssh host "tail -f /var/log/app.log"', "tail -f"],
-		['ssh host "npm run dev"', "npm run dev"],
-		[
-			'ssh host "python -m my_package.daemon --poll"',
-			"python -m with daemon in module path",
-		],
-	];
-	risky.forEach(([cmd, label]) => {
-		it(`RISKY: ${label}`, () => {
-			assert.strictEqual(isForegroundDaemonSsh(cmd), true, cmd.slice(0, 80));
-		});
-	});
-
-	const safe: Array<[string, string]> = [
-		["ssh host 'ls -la'", "plain remote command"],
-		[
-			"timeout 60s ssh -o BatchMode=yes host 'uvicorn main:app'",
-			"local timeout guard",
-		],
-		[
-			"ssh host 'timeout 30 python -m amos_worker --video'",
-			"remote timeout guard",
-		],
-		[
-			"ssh host 'nohup python -m amos_worker --video > /tmp/w.log 2>&1 & echo DONE'",
-			"nohup detached",
-		],
-		["ssh -f host 'uvicorn main:app'", "ssh -f backgrounds itself"],
-		[
-			"python -m amos_worker --video",
-			"local (non-ssh) daemon command — not our scope",
-		],
-		["curl https://example.com", "not ssh"],
-	];
-	safe.forEach(([cmd, label]) => {
-		it(`SAFE: ${label}`, () => {
-			assert.strictEqual(isForegroundDaemonSsh(cmd), false, cmd.slice(0, 80));
-		});
-	});
-});
-
-describe("addSshTimeoutGuard", () => {
-	it("prefixes the ssh segment with timeout, preserving pipeline prefix", () => {
-		const cmd = "echo 'x' | ssh -tt host \"python -m amos_worker --video\"";
-		assert.strictEqual(
-			addSshTimeoutGuard(cmd, 300),
-			"echo 'x' | timeout 300s ssh -tt host \"python -m amos_worker --video\"",
-		);
-	});
-
-	it("uses default seconds when omitted", () => {
-		const cmd = "ssh host 'uvicorn main:app'";
-		assert.ok(addSshTimeoutGuard(cmd).startsWith("timeout "));
-		assert.ok(addSshTimeoutGuard(cmd).includes("s ssh host"));
-	});
-
-	it("invalid seconds returns command unchanged", () => {
-		const cmd = "ssh host 'uvicorn main:app'";
-		assert.strictEqual(addSshTimeoutGuard(cmd, 0), cmd);
-		assert.strictEqual(addSshTimeoutGuard(cmd, NaN), cmd);
-	});
-
-	it("non-ssh command returns unchanged", () => {
-		assert.strictEqual(addSshTimeoutGuard("ls -la"), "ls -la");
-	});
-});
-
-describe("getDefaultSshTimeoutSeconds", () => {
-	it("defaults to 300", () => {
-		delete process.env.PI_HARNESS_SSH_TIMEOUT_S;
-		assert.strictEqual(getDefaultSshTimeoutSeconds(), 300);
-	});
-
-	it("honours PI_HARNESS_SSH_TIMEOUT_S", () => {
-		const prev = process.env.PI_HARNESS_SSH_TIMEOUT_S;
-		try {
-			process.env.PI_HARNESS_SSH_TIMEOUT_S = "120";
-			assert.strictEqual(getDefaultSshTimeoutSeconds(), 120);
-			process.env.PI_HARNESS_SSH_TIMEOUT_S = "bogus";
-			assert.strictEqual(getDefaultSshTimeoutSeconds(), 300);
-		} finally {
-			if (prev === undefined) delete process.env.PI_HARNESS_SSH_TIMEOUT_S;
-			else process.env.PI_HARNESS_SSH_TIMEOUT_S = prev;
-		}
-	});
-});
-
-describe("detectSsh (timeout guard)", () => {
-	it("flags foreground daemon ssh with timeout suggestion", () => {
-		const result = detectSsh("ssh -tt host 'python -m amos_worker --video'");
-		assert.strictEqual(result.needsTimeoutGuard, true);
-		assert.ok(result.suggestion.includes("timeout"));
-	});
-
-	it("no timeout flag for plain ssh", () => {
-		const result = detectSsh("ssh host 'ls -la'");
-		assert.strictEqual(result.needsTimeoutGuard, false);
-	});
-});

package/harness/ssh-hang-recovery.test.ts

@@ -1,86 +0,0 @@
-/**
- * SSH Hang Recovery — tests for the shell-safety helpers.
- *
- * The host, the user and the command all reach a shell. A value that is
- * quoted cannot end the quote, and a value that does not look like a host
- * is rejected before it is ever passed on.
- */
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import { shellQuote, assertSafeSshTarget } from "./ssh-hang-recovery.js";
-
-describe("shellQuote", () => {
-	it("wraps a plain value in single quotes", () => {
-		assert.strictEqual(shellQuote("pm2 status"), "'pm2 status'");
-	});
-
-	it("neutralizes a value that would close the quote", () => {
-		// The classic breakout: ' ; rm -rf / ; '
-		const payload = "'; rm -rf / ; '";
-		const quoted = shellQuote(payload);
-		// Every ' of the payload is closed, escaped and reopened, so the
-		// payload can never leave the quoted string.
-		assert.strictEqual(quoted, "''\\''; rm -rf / ; '\\'''");
-		// The quoted form has an even number of quotes: it parses as one
-		// literal string, whatever the payload was.
-		assert.strictEqual((quoted.match(/'/g) || []).length % 2, 0);
-	});
-
-	it("neutralizes a command substitution", () => {
-		const quoted = shellQuote("$(whoami)");
-		assert.strictEqual(quoted, "'$(whoami)'");
-	});
-
-	it("neutralizes a backtick substitution", () => {
-		const quoted = shellQuote("`id`");
-		assert.strictEqual(quoted, "'`id`'");
-	});
-
-	it("keeps a newline inside the quotes", () => {
-		const quoted = shellQuote("a\nb");
-		assert.strictEqual(quoted, "'a\nb'");
-	});
-});
-
-describe("assertSafeSshTarget", () => {
-	it("accepts a DNS name", () => {
-		assert.doesNotThrow(() => assertSafeSshTarget("example.com", "deploy"));
-	});
-
-	it("accepts an IPv4 address", () => {
-		assert.doesNotThrow(() => assertSafeSshTarget("203.0.113.10", "deploy"));
-	});
-
-	it("accepts a bracketed IPv6 address", () => {
-		assert.doesNotThrow(() => assertSafeSshTarget("[2001:db8::1]", "deploy"));
-	});
-
-	it("rejects a host that carries a command", () => {
-		assert.throws(
-			() => assertSafeSshTarget("example.com; rm -rf /", "deploy"),
-			/invalid ssh host/,
-		);
-	});
-
-	it("rejects a host that carries a substitution", () => {
-		assert.throws(
-			() => assertSafeSshTarget("$(whoami).example.com", "deploy"),
-			/invalid ssh host/,
-		);
-	});
-
-	it("rejects a host with a space", () => {
-		assert.throws(() => assertSafeSshTarget("a b", "deploy"), /invalid ssh host/);
-	});
-
-	it("rejects a user that carries a command", () => {
-		assert.throws(
-			() => assertSafeSshTarget("example.com", "root; rm -rf /"),
-			/invalid ssh user/,
-		);
-	});
-
-	it("rejects a user with a shell metacharacter", () => {
-		assert.throws(() => assertSafeSshTarget("example.com", "a$b"), /invalid ssh user/);
-	});
-});