publishport-opencli 1.8.5-pp.2 → 1.8.5-pp.21

package/clis/slock/message-send.test.js

@@ -1,127 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { ArgumentError, AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
-import { getRegistry } from '@jackwener/opencli/registry';
-import './message-send.js';
-
-function makePage(result = { kind: 'ok', rows: [{ id: 'm1' }] }) {
-  return { goto: vi.fn(), evaluate: vi.fn().mockResolvedValue(result) };
-}
-
-describe('slock message-send', () => {
-  const command = getRegistry().get('slock/message-send');
-
-  it('channel-name target embeds the lowercased name into the snippet', async () => {
-    const page = makePage();
-    await command.func(page, { target: '#general', content: 'hi' });
-    expect(page.evaluate.mock.calls[0][0]).toContain('"general"');
-  });
-
-  it('dm:@name target embeds member-lookup + DM channel creation', async () => {
-    const page = makePage();
-    await command.func(page, { target: 'dm:@alice', content: 'hi' });
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).toContain('/members');
-    expect(script).toContain('/channels/dm');
-  });
-
-  it('thread short-id target embeds /messages/context + parent /threads', async () => {
-    const page = makePage();
-    await command.func(page, { target: '#general:8af3cbbb', content: 'reply' });
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).toContain('/messages/context');
-    expect(script).toContain('/threads');
-  });
-
-  it('[red-line] thread unresolvable → ArgumentError + zero network writes', async () => {
-    const page = makePage({ kind: 'unresolvable', detail: 'short id had 0 matches' });
-    await expect(command.func(page, { target: '#general:zzzzzzzz', content: 'hi' }))
-      .rejects.toBeInstanceOf(ArgumentError);
-    // The single evaluate is allowed (read-side resolution); the snippet returns
-    // 'unresolvable' BEFORE any /messages POST, which the mock proves.
-    expect(page.evaluate).toHaveBeenCalledTimes(1);
-  });
-
-  it('[red-line] --dry-run returns a plan row and never calls evaluate', async () => {
-    const page = makePage();
-    const rows = await command.func(page, { target: '#general', content: 'hi', 'dry-run': true });
-    expect(page.evaluate).not.toHaveBeenCalled();
-    expect(rows[0]).toMatchObject({ result: 'dry-run', content: 'hi', target: '#general' });
-  });
-
-  it('[red-line] content is sent byte-equal — the snippet body contains the EXACT input string', async () => {
-    const tricky = `pizza 🍕 + \n + </script> + "quotes"`;
-    const page = makePage();
-    await command.func(page, { target: '#general', content: tricky });
-    const script = page.evaluate.mock.calls[0][0];
-    // The snippet must JSON-encode the content; the encoded form must round-trip back exactly.
-    const m = script.match(/content:\s*(".*?[^\\]")/);
-    expect(m).not.toBeNull();
-    expect(JSON.parse(m[1])).toBe(tricky);
-  });
-
-  it('error mapping: parametric coverage of auth / http / no-server', async () => {
-    await expect(command.func(makePage({ kind: 'auth', detail: '401' }), { target: '#g', content: 'x' }))
-      .rejects.toBeInstanceOf(AuthRequiredError);
-    await expect(command.func(makePage({ kind: 'http', status: 500, where: '/messages' }), { target: '#g', content: 'x' }))
-      .rejects.toBeInstanceOf(CommandExecutionError);
-  });
-
-  it('[postcondition] rejects 2xx send responses that do not return a message id', async () => {
-    await expect(command.func(makePage({ kind: 'ok', rows: [{ channelId: 'c1' }] }), { target: '#g', content: 'x' }))
-      .rejects.toThrow(/message id/);
-  });
-
-  it('--server override passes the override into the snippet', async () => {
-    const page = makePage();
-    await command.func(page, { target: '#general', content: 'hi', server: 'design' });
-    expect(page.evaluate.mock.calls[0][0]).toContain('"design"');
-  });
-
-  it('--as-task adds asTask:true to the POST body', async () => {
-    const page = makePage();
-    await command.func(page, { target: '#general', content: 'ship it', 'as-task': true });
-    expect(page.evaluate.mock.calls[0][0]).toContain('asTask: true');
-  });
-
-  it('--attach embeds the attachmentId UUIDs in the body', async () => {
-    const page = makePage();
-    const a = '550e8400-e29b-41d4-a716-446655440000';
-    const b = '550e8400-e29b-41d4-a716-446655440001';
-    await command.func(page, { target: '#general', content: 'files', attach: `${a}, ${b}` });
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).toContain('attachmentIds');
-    expect(script).toContain(a);
-    expect(script).toContain(b);
-  });
-
-  it('--attach rejects a non-UUID id before navigation', async () => {
-    const page = makePage();
-    await expect(command.func(page, { target: '#general', content: 'x', attach: 'not-a-uuid' }))
-      .rejects.toBeInstanceOf(ArgumentError);
-    expect(page.goto).not.toHaveBeenCalled();
-  });
-
-  it('--as-task is reflected in the --dry-run plan row', async () => {
-    const page = makePage();
-    const rows = await command.func(page, { target: '#general', content: 'hi', 'as-task': true, 'dry-run': true });
-    expect(page.evaluate).not.toHaveBeenCalled();
-    expect(rows[0]).toMatchObject({ result: 'dry-run (asTask)' });
-  });
-
-  it('[red-line] a channel name with a quote cannot break out of the snippet string', async () => {
-    const page = makePage({ kind: 'unresolvable', detail: 'x' });
-    await command.func(page, { target: "#ev'il", content: 'x' }).catch(() => {});
-    const script = page.evaluate.mock.calls[0][0];
-    // Vulnerable form would embed the name raw as `matches ev'il`, letting the
-    // quote close the string literal. The name must only appear JSON-encoded.
-    expect(script).not.toContain("no channel matches ev'il");
-    expect(script).toContain('"ev\'il"');
-  });
-
-  it('[red-line] a dm:@name with a quote is JSON-encoded, not interpolated raw', async () => {
-    const page = makePage({ kind: 'unresolvable', detail: 'x' });
-    await command.func(page, { target: "dm:@ev'il", content: 'x' }).catch(() => {});
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).not.toContain("no member @ev'il");
-  });
-});

package/clis/slock/reaction-add.test.js

@@ -1,36 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { ArgumentError } from '@jackwener/opencli/errors';
-import { getRegistry } from '@jackwener/opencli/registry';
-import './reaction-add.js';
-
-const UUID = '550e8400-e29b-41d4-a716-446655440000';
-function makePage(result = { kind: 'ok', rows: { id: 'm1' } }) {
-  return { goto: vi.fn(), evaluate: vi.fn().mockResolvedValue(result) };
-}
-
-describe('slock reaction-add', () => {
-  const command = getRegistry().get('slock/reaction-add');
-
-  it('short id is rejected before navigation', async () => {
-    const page = makePage();
-    await expect(command.func(page, { messageId: '8af3cbbb', emoji: '👍' }))
-      .rejects.toThrow(/NOT accepted/);
-    expect(page.goto).not.toHaveBeenCalled();
-  });
-
-  it('missing emoji throws ArgumentError before navigation', async () => {
-    const page = makePage();
-    await expect(command.func(page, { messageId: UUID, emoji: '  ' }))
-      .rejects.toBeInstanceOf(ArgumentError);
-    expect(page.goto).not.toHaveBeenCalled();
-  });
-
-  it('full UUID + emoji POSTs to /messages/:id/reactions and returns added', async () => {
-    const page = makePage();
-    const rows = await command.func(page, { messageId: UUID, emoji: '👍' });
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).toContain(`/api/messages/${UUID}/reactions`);
-    expect(script).toContain('emoji'); // body is {emoji}, server validates via parseReactionEmoji
-    expect(rows[0]).toMatchObject({ messageId: UUID, emoji: '👍', result: 'added' });
-  });
-});

package/clis/slock/reaction-remove.test.js

@@ -1,29 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { getRegistry } from '@jackwener/opencli/registry';
-import './reaction-remove.js';
-
-const UUID = '550e8400-e29b-41d4-a716-446655440000';
-function makePage(result = { kind: 'ok', rows: { id: 'm1' } }) {
-  return { goto: vi.fn(), evaluate: vi.fn().mockResolvedValue(result) };
-}
-
-describe('slock reaction-remove', () => {
-  const command = getRegistry().get('slock/reaction-remove');
-
-  it('short id is rejected before navigation', async () => {
-    const page = makePage();
-    await expect(command.func(page, { messageId: '8af3cbbb', emoji: '👍' }))
-      .rejects.toThrow(/NOT accepted/);
-    expect(page.goto).not.toHaveBeenCalled();
-  });
-
-  it('full UUID + emoji DELETEs /messages/:id/reactions and returns removed', async () => {
-    const page = makePage();
-    const rows = await command.func(page, { messageId: UUID, emoji: '👍' });
-    const script = page.evaluate.mock.calls[0][0];
-    expect(script).toContain(`/api/messages/${UUID}/reactions`);
-    expect(script).toContain('"DELETE"');
-    expect(script).toContain('emoji'); // body is {emoji}
-    expect(rows[0]).toMatchObject({ messageId: UUID, emoji: '👍', result: 'removed' });
-  });
-});

package/clis/slock/resolve.test.js

@@ -1,102 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { ArgumentError } from '@jackwener/opencli/errors';
-import { UUID_RE } from './resolve.js';
-import { classifyThreadTarget } from './resolve.js';
-import { classifyTarget } from './resolve.js';
-import { assertMessageIdShape } from './resolve.js';
-import { parseNonNegativeInteger, parsePositiveInteger } from './resolve.js';
-
-describe('UUID_RE', () => {
-  it('matches a v4-shaped uuid', () => {
-    expect(UUID_RE.test('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
-  });
-
-  it('rejects a short id (8 hex chars)', () => {
-    expect(UUID_RE.test('8af3cbbb')).toBe(false);
-  });
-});
-
-describe('classifyThreadTarget', () => {
-  it('parses "#name:short" into parent + short msg id', () => {
-    expect(classifyThreadTarget('#general:8af3cbbb')).toEqual({
-      parentTarget: '#general',
-      parentMsgId: '8af3cbbb',
-    });
-  });
-
-  it('parses "uuid:short" with raw channel uuid as parent', () => {
-    expect(classifyThreadTarget('550e8400-e29b-41d4-a716-446655440000:8af3cbbb')).toEqual({
-      parentTarget: '550e8400-e29b-41d4-a716-446655440000',
-      parentMsgId: '8af3cbbb',
-    });
-  });
-
-  it('returns null when the suffix is shorter than 6 chars (not a thread shape)', () => {
-    expect(classifyThreadTarget('#general:abc')).toBeNull();
-  });
-});
-
-describe('classifyTarget', () => {
-  it('treats "#name" as a channel-name target', () => {
-    expect(classifyTarget('#general')).toEqual({ kind: 'channel-name', name: 'general' });
-  });
-
-  it('treats a raw 36-char uuid as a channel-uuid target', () => {
-    expect(classifyTarget('550e8400-e29b-41d4-a716-446655440000')).toEqual({
-      kind: 'channel-uuid',
-      channelId: '550e8400-e29b-41d4-a716-446655440000',
-    });
-  });
-
-  it('treats "dm:@name" as a dm-name target', () => {
-    expect(classifyTarget('dm:@alice')).toEqual({ kind: 'dm-name', name: 'alice' });
-  });
-
-  it('rejects "dm:not-a-uuid" with an ArgumentError-shaped throw', () => {
-    expect(() => classifyTarget('dm:nope')).toThrow(/dm target must be/);
-  });
-});
-
-describe('assertMessageIdShape', () => {
-  it('returns the trimmed UUID when shape is valid', () => {
-    const v = '  550e8400-e29b-41d4-a716-446655440000  ';
-    expect(assertMessageIdShape(v)).toBe('550e8400-e29b-41d4-a716-446655440000');
-  });
-
-  it('rejects short ids with a hint mentioning "NOT accepted"', () => {
-    expect(() => assertMessageIdShape('8af3cbbb')).toThrow(/NOT accepted/);
-  });
-
-  // Typed-error contract: helpers throw ArgumentError directly so a future
-  // caller that forgets the try/rewrap still surfaces a CliError subclass.
-  it('throws ArgumentError (not raw Error) so unwrapped callers stay typed', () => {
-    expect(() => assertMessageIdShape('8af3cbbb')).toThrow(ArgumentError);
-    expect(() => classifyTarget('dm:')).toThrow(ArgumentError);
-  });
-});
-
-describe('integer boundary helpers', () => {
-  it('parsePositiveInteger accepts positive integers and defaults', () => {
-    expect(parsePositiveInteger(undefined, '--limit', { defaultValue: 50 })).toBe(50);
-    expect(parsePositiveInteger('3', '--limit')).toBe(3);
-    expect(parsePositiveInteger(3, '--limit')).toBe(3);
-  });
-
-  it('parsePositiveInteger rejects zero, negatives, fractions, and max overflow', () => {
-    expect(() => parsePositiveInteger(0, '--limit')).toThrow(ArgumentError);
-    expect(() => parsePositiveInteger(-1, '--limit')).toThrow(ArgumentError);
-    expect(() => parsePositiveInteger(1.5, '--limit')).toThrow(ArgumentError);
-    expect(() => parsePositiveInteger('1e2', '--limit')).toThrow(ArgumentError);
-    expect(() => parsePositiveInteger(' 3 ', '--limit')).toThrow(ArgumentError);
-    expect(() => parsePositiveInteger(101, '--limit', { max: 100 })).toThrow(ArgumentError);
-  });
-
-  it('parseNonNegativeInteger accepts zero but rejects negatives and fractions', () => {
-    expect(parseNonNegativeInteger(undefined, '--offset', { defaultValue: 0 })).toBe(0);
-    expect(parseNonNegativeInteger('0', '--offset')).toBe(0);
-    expect(parseNonNegativeInteger(2, '--offset')).toBe(2);
-    expect(() => parseNonNegativeInteger(-1, '--offset')).toThrow(ArgumentError);
-    expect(() => parseNonNegativeInteger(1.5, '--offset')).toThrow(ArgumentError);
-    expect(() => parseNonNegativeInteger('1e2', '--offset')).toThrow(ArgumentError);
-  });
-});

package/clis/slock/server-list.test.js

@@ -1,24 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { getRegistry } from '@jackwener/opencli/registry';
-import './server-list.js';
-
-describe('slock server-list', () => {
-  const command = getRegistry().get('slock/server-list');
-
-  it('marks the active server based on localStorage slug', async () => {
-    const page = {
-      goto: vi.fn(),
-      evaluate: vi.fn().mockResolvedValue({
-        kind: 'ok',
-        rows: [
-          { id: 's1', slug: 'eng', name: 'Engineering' },
-          { id: 's2', slug: 'design', name: 'Design' },
-        ],
-        meta: { activeSlug: 'design' },
-      }),
-    };
-    const rows = await command.func(page, {});
-    expect(rows.find((r) => r.slug === 'design').active).toBe(true);
-    expect(rows.find((r) => r.slug === 'eng').active).toBe(false);
-  });
-});

package/clis/slock/server-override-canary.test.js

@@ -1,87 +0,0 @@
-// server-override-canary.test.js
-//
-// R1 drift catch (source-level, registry-wide): any slock command that
-// scopes to a server MUST route its X-Server-Id through authHeadersFragment.
-// authHeadersFragment owns the UUID-vs-slug resolution against /servers/;
-// a hand-rolled `let sid = ${override}; if (!sid) {...}` copy in a
-// command file is the bug class that landed Jacky's `--server community`
-// at HTTP 500 even though the active-slug path was fine.
-//
-// This canary scans every clis/slock/*.js file for the offending shape
-// and asserts that any file that mentions `x-server-id` (the request
-// header) does so via authHeadersFragment, not its own header object.
-// It catches the message-read / message-search / message-send class of
-// inline-copy bugs that R1 v1 missed (the byte-verify mocks never set a
-// slug override, so the copies went unnoticed until live).
-
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-
-const DIR = path.dirname(fileURLToPath(import.meta.url));
-
-function stripComments(src) {
-  return src
-    .replace(/\/\*[\s\S]*?\*\//g, '')
-    .replace(/\/\/.*$/gm, '');
-}
-
-describe('slock R1 server-override canary', () => {
-  it('no clis/slock/*.js (except in-page.js) hand-rolls a `let sid = <override>; if (!sid)` server-resolve copy', () => {
-    const files = readdirSync(DIR)
-      .filter((f) => f.endsWith('.js') && !f.endsWith('.test.js'));
-
-    const offenders = [];
-    for (const f of files) {
-      // in-page.js is the single source of truth — it OWNS the resolve.
-      if (f === 'in-page.js') continue;
-      // shared.js holds constants only.
-      if (f === 'shared.js') continue;
-      const src = stripComments(readFileSync(path.join(DIR, f), 'utf8'));
-
-      // The offending inline-copy shape: a `let sid` declaration followed
-      // (within a snippet) by an `if (!sid)` block that does its own
-      // /servers/ lookup. Match across newlines because snippets are
-      // formatted as template literals.
-      const inlineCopy = /let\s+sid\s*=[^;]*;\s*if\s*\(\s*!\s*sid\s*\)/s;
-      if (inlineCopy.test(src)) {
-        offenders.push(`${f} (inline \`let sid = ...; if (!sid)\` copy)`);
-      }
-
-      // Also: hand-crafting `'x-server-id'` in a headers literal is a smell.
-      // The only place that should set this header is authHeadersFragment.
-      // (in-page.js excluded above, so any hit here is a copy.)
-      if (/['"]x-server-id['"]\s*:/.test(src)) {
-        offenders.push(`${f} (hand-crafted 'x-server-id' header in source)`);
-      }
-    }
-
-    expect(offenders).toEqual([]);
-  });
-
-  it('any file that mentions /servers/ either IS in-page.js or imports authHeadersFragment', () => {
-    const files = readdirSync(DIR)
-      .filter((f) => f.endsWith('.js') && !f.endsWith('.test.js'));
-
-    const offenders = [];
-    for (const f of files) {
-      if (f === 'in-page.js' || f === 'shared.js') continue;
-      const src = readFileSync(path.join(DIR, f), 'utf8');
-      const noComments = stripComments(src);
-      // server-use legitimately fetches /servers/ for its own purpose
-      // (setting active-slug) and explicitly does not use the auth
-      // header chain. Exempt by name.
-      if (f === 'server-use.js' || f === 'server-list.js') continue;
-      // unread-summary makes a /servers/ probe too (separate flow).
-      if (f === 'unread-summary.js') continue;
-      if (!/\/servers\//.test(noComments)) continue;
-      // Any other file mentioning /servers/ is suspicious — it should be
-      // delegating to authHeadersFragment.
-      if (!/authHeadersFragment/.test(noComments)) {
-        offenders.push(`${f} touches /servers/ without authHeadersFragment`);
-      }
-    }
-    expect(offenders).toEqual([]);
-  });
-});

package/clis/slock/server-use.test.js

@@ -1,48 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { ArgumentError } from '@jackwener/opencli/errors';
-import { getRegistry } from '@jackwener/opencli/registry';
-import './server-use.js';
-
-describe('slock server-use', () => {
-  const command = getRegistry().get('slock/server-use');
-
-  it('writes localStorage when the slug resolves', async () => {
-    const page = {
-      goto: vi.fn(),
-      evaluate: vi.fn().mockResolvedValue({
-        kind: 'ok',
-        rows: [{ slug: 'eng', id: 's1', name: 'Engineering' }],
-        meta: { written: true, newSlug: 'eng' },
-      }),
-    };
-    const rows = await command.func(page, { input: '#engineering' });
-    expect(rows[0]).toMatchObject({ slug: 'eng', written: true });
-  });
-
-  it('atomicity: when slug is unknown, returns unresolvable and meta.written is false', async () => {
-    const page = {
-      goto: vi.fn(),
-      evaluate: vi.fn().mockResolvedValue({ kind: 'unresolvable', detail: 'unknown slug "ops"' }),
-    };
-    await expect(command.func(page, { input: 'ops' })).rejects.toBeInstanceOf(ArgumentError);
-  });
-
-  it('rejects empty input before navigation', async () => {
-    const page = { goto: vi.fn(), evaluate: vi.fn() };
-    await expect(command.func(page, { input: '' })).rejects.toBeInstanceOf(ArgumentError);
-    expect(page.goto).not.toHaveBeenCalled();
-  });
-
-  it('[red-line] an input with a quote cannot break out of the snippet string', async () => {
-    const page = {
-      goto: vi.fn(),
-      evaluate: vi.fn().mockResolvedValue({ kind: 'unresolvable', detail: 'x' }),
-    };
-    await command.func(page, { input: "ev'il" }).catch(() => {});
-    const script = page.evaluate.mock.calls[0][0];
-    // Vulnerable form embedded the input raw as `matches "ev'il"`, letting the
-    // quote close the string literal. The input must only appear JSON-encoded.
-    expect(script).not.toContain('no server matches "ev\'il"');
-    expect(script).toContain('"ev\'il"');
-  });
-});

package/clis/slock/short-id-canary.test.js

@@ -1,86 +0,0 @@
-// short-id-canary.test.js
-//
-// R3 drift catch (source-level, registry-wide): the short-id → full-UUID
-// resolution (`#channel:shortId` via GET /api/messages/context/...) used to
-// be copy-pasted into message-read, message-send, and task-convert. The
-// Phase 7.1 bug class — reading `m.message.id` instead of
-// `cxd.targetMessageId`, or mapping the context-404 to NO_THREAD — bit us
-// in every previous rewrite because each consumer carried its own copy.
-//
-// R3 consolidates that resolution into a single helper in in-page.js
-// (`resolveShortIdFragment`). This canary scans every other clis/slock/*.js
-// for the offending copy shape and asserts that any file referencing
-// `cxd.targetMessageId` does so via the helper, not by hand.
-//
-// ⚠️ EXEMPTION: message-read.js also calls /api/messages/context for the
-// `--after <seq>` anchor flow (line ~143). That is a SEPARATE consumer:
-// it reads `cxd.messages` to find a seq anchor, NEVER mutates a shortId
-// variable, and does NOT read targetMessageId. The canary keys on the
-// shortId-resolve fingerprint (`fullMsgId = cxd.targetMessageId` and
-// friends), so the --after path is naturally not flagged.
-
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-
-const DIR = path.dirname(fileURLToPath(import.meta.url));
-
-function stripComments(src) {
-  return src
-    .replace(/\/\*[\s\S]*?\*\//g, '')
-    .replace(/\/\/.*$/gm, '');
-}
-
-describe('slock R3 short-id resolution canary', () => {
-  it('no clis/slock/*.js (except in-page.js) hand-rolls a short-id → cxd.targetMessageId resolution', () => {
-    const files = readdirSync(DIR)
-      .filter((f) => f.endsWith('.js') && !f.endsWith('.test.js'));
-
-    const offenders = [];
-    for (const f of files) {
-      // in-page.js OWNS resolveShortIdFragment.
-      if (f === 'in-page.js') continue;
-      if (f === 'shared.js') continue;
-      const src = stripComments(readFileSync(path.join(DIR, f), 'utf8'));
-
-      // Fingerprint of the inline-copy short-id resolve: an ASSIGNMENT
-      // whose right-hand side is `cxd.targetMessageId`. The --after
-      // seq-anchor flow legitimately COMPARES against targetMessageId
-      // (`m.messageId === cxd.targetMessageId`), so the regex must
-      // exclude comparison operators. Negative lookbehind `(?<![=!])`
-      // rules out `==`/`===`/`!=`/`!==`.
-      if (/(?<![=!])=\s*cxd\.targetMessageId/.test(src)) {
-        offenders.push(`${f} (assigns from cxd.targetMessageId — should call resolveShortIdFragment)`);
-      }
-    }
-
-    expect(offenders).toEqual([]);
-  });
-
-  it('all 3 known short-id consumers import resolveShortIdFragment from in-page.js', () => {
-    const expected = ['message-read.js', 'message-send.js', 'task-convert.js'];
-    const missing = [];
-    for (const f of expected) {
-      const src = readFileSync(path.join(DIR, f), 'utf8');
-      if (!/resolveShortIdFragment/.test(src)) {
-        missing.push(`${f} (still hand-rolls short-id resolution)`);
-      }
-    }
-    expect(missing).toEqual([]);
-  });
-
-  it('exempt --after seq-anchor flow in message-read.js still uses /messages/context (regression catch — do not delete it by accident)', () => {
-    const src = readFileSync(path.join(DIR, 'message-read.js'), 'utf8');
-    // The --after flow walks the cxd.messages array to find the seq
-    // anchor for a UUID. It MUST still appear in source — if a future
-    // refactor strips it, --after <UUID> stops working silently.
-    expect(src).toMatch(/\/messages\/context\/'?\s*\+\s*encodeURIComponent\(afterSeq\)/);
-    expect(src).toMatch(/cxd\.messages/);
-    // It legitimately compares against cxd.targetMessageId (`m.id ===
-    // cxd.targetMessageId`) to find the right row — that comparison
-    // form must stay, distinct from the assignment form the short-id
-    // helper owns.
-    expect(src).toMatch(/===\s*cxd\.targetMessageId/);
-  });
-});

package/clis/slock/site-session-canary.test.js

@@ -1,49 +0,0 @@
-// site-session-canary.test.js
-//
-// Registry-based drift catch (NOT grep-based): every slock command that uses
-// the cookie/browser strategy MUST declare siteSession='persistent'. The
-// framework default is 'ephemeral' (see src/execution.ts:497), which means
-// without this flag, the command spins up a fresh browser profile that does
-// NOT share localStorage with the `login` command's persistent profile.
-// Result: a fully successful `login` leaves every other command reading an
-// empty profile → AUTH_REQUIRED.
-//
-// We discover commands via the registry (not grep over clis/slock/*.js)
-// because `whoami` and `login` are registered from clis/_shared/site-auth.js,
-// and a grep approach would miss them. Registry iteration also covers any
-// future Ph10+ commands the moment they get registered — drift-proof.
-
-import { describe, it, expect } from 'vitest';
-import { readdirSync } from 'node:fs';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import path from 'node:path';
-import { getRegistry } from '@jackwener/opencli/registry';
-
-const DIR = path.dirname(fileURLToPath(import.meta.url));
-
-describe('slock site-session canary', () => {
-  it('every cookie/browser slock command sets siteSession="persistent" (shares login\'s profile)', async () => {
-    // Side-effect-import every adapter .js in this directory so cli() runs.
-    const files = readdirSync(DIR)
-      .filter((f) => f.endsWith('.js') && !f.endsWith('.test.js'));
-    for (const f of files) {
-      await import(pathToFileURL(path.join(DIR, f)).href);
-    }
-
-    const registry = getRegistry();
-    const slock = [...registry.entries()].filter(([k]) => k.startsWith('slock/'));
-
-    // Sanity: at least the ~44 commands we expect from Ph0-9 — guards
-    // against the test silently passing if discovery somehow returned 0.
-    expect(slock.length).toBeGreaterThan(40);
-
-    const offenders = slock
-      // Only cookie/browser commands need a persistent session. PUBLIC /
-      // browserless commands aren't affected.
-      .filter(([, cmd]) => cmd.strategy === 'cookie' && cmd.browser)
-      .filter(([, cmd]) => cmd.siteSession !== 'persistent')
-      .map(([k, cmd]) => `${k} (siteSession=${cmd.siteSession ?? 'unset (defaults ephemeral)'})`);
-
-    expect(offenders).toEqual([]);
-  });
-});