qlogicagent 2.13.5 → 2.13.6

package/dist/cli/handlers/community-handler.test.js

@@ -1,1602 +0,0 @@
-import * as fs from "node:fs/promises";
-import { createHash } from "node:crypto";
-import * as path from "node:path";
-import { tmpdir } from "node:os";
-import { gzipSync } from "node:zlib";
-import { describe, expect, it, vi } from "vitest";
-import { AGENT_RPC_ERROR_CODES } from "../../protocol/wire/index.js";
-import * as communityHandlers from "./community-handler.js";
-import { handleCommunityGetConsent, handleCommunityListShared, handleCommunityListNotices, handleCommunityMarkNoticeRead, handleCommunityMatchRegistry, handleCommunityPublishSkill, handleCommunityRecordSignal, handleCommunityRecordTelemetry, handleCommunitySetConsent, handleCommunityWithdrawAllShared, handleCommunityWithdrawShared, } from "./community-handler.js";
-function disabledConsent() {
-    return {
-        enabled: false,
-        methodSharingEnabled: false,
-        signalsEnabled: false,
-        encounterEnabled: false,
-        remoteSynced: false,
-    };
-}
-function enabledConsent(overrides = {}) {
-    return {
-        enabled: true,
-        methodSharingEnabled: true,
-        signalsEnabled: true,
-        encounterEnabled: true,
-        remoteSynced: true,
-        ...overrides,
-    };
-}
-function skillPublishParams() {
-    return {
-        id: "email-ops",
-        title: "Email Ops",
-        summary: "Send and triage email",
-        visibility: "public",
-        tags: ["email"],
-        manifest: {
-            schema_version: 15,
-            kind: "inert",
-            name: "Email Ops",
-            summary: "Send and triage email",
-            description: "Reusable skill for triaging email.",
-            triggers: ["email"],
-            entry: "SKILL.md",
-        },
-    };
-}
-function unusedCommunityWriteMethods() {
-    return {
-        async matchRegistry() {
-            throw new Error("not used");
-        },
-        async publishSkill() {
-            throw new Error("not used");
-        },
-        async publishPet() {
-            throw new Error("not used");
-        },
-        async publishWorkflow() {
-            throw new Error("not used");
-        },
-        async recordSignal() {
-            throw new Error("not used");
-        },
-        async recordTelemetry() {
-            throw new Error("not used");
-        },
-        async resolveInstall() {
-            throw new Error("not used");
-        },
-    };
-}
-function makeStore(initial) {
-    let value = initial ?? disabledConsent();
-    const writes = [];
-    return {
-        writes,
-        async read() {
-            return value;
-        },
-        async write(next) {
-            value = next;
-            writes.push(next);
-        },
-    };
-}
-function makeHost(options = {}) {
-    const responses = [];
-    return {
-        responses,
-        resolveCommunityConsentStore: () => options.store ?? makeStore(),
-        resolveCommunityConsentClient: () => options.client ?? null,
-        sendResponse(id, result, error) {
-            responses.push({ id, result, error });
-        },
-    };
-}
-function getResolveInstallHandler() {
-    const handler = communityHandlers.handleCommunityResolveInstall;
-    expect(handler).toBeTypeOf("function");
-    return handler;
-}
-function getInstallResourceHandler() {
-    const handler = communityHandlers.handleCommunityInstallResource;
-    expect(handler).toBeTypeOf("function");
-    return handler;
-}
-function makeSkillPackage(skillMd) {
-    return gzipSync(makeTar([{ name: "SKILL.md", content: Buffer.from(skillMd, "utf8") }]));
-}
-function makeTar(entries) {
-    const chunks = [];
-    for (const entry of entries) {
-        const header = Buffer.alloc(512);
-        header.write(entry.name, 0, "utf8");
-        header.write("0000644\0", 100, "ascii");
-        header.write("0000000\0", 108, "ascii");
-        header.write("0000000\0", 116, "ascii");
-        header.write(entry.content.length.toString(8).padStart(11, "0") + "\0", 124, "ascii");
-        header.write(Math.floor(Date.now() / 1000).toString(8).padStart(11, "0") + "\0", 136, "ascii");
-        header.fill(0x20, 148, 156);
-        header.write("0", 156, "ascii");
-        header.write("ustar\0", 257, "ascii");
-        header.write("00", 263, "ascii");
-        const checksum = [...header].reduce((sum, value) => sum + value, 0);
-        header.write(checksum.toString(8).padStart(6, "0") + "\0 ", 148, "ascii");
-        chunks.push(header, entry.content);
-        const padding = (512 - (entry.content.length % 512)) % 512;
-        if (padding > 0)
-            chunks.push(Buffer.alloc(padding));
-    }
-    chunks.push(Buffer.alloc(1024));
-    return Buffer.concat(chunks);
-}
-describe("community consent handler", () => {
-    it("defaults every community scope off when no consent has been saved", async () => {
-        const host = makeHost({ store: makeStore() });
-        await handleCommunityGetConsent.call(host, {
-            jsonrpc: "2.0",
-            id: "community-1",
-            method: "community.getConsent",
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-1",
-            result: {
-                ok: true,
-                remoteAvailable: false,
-                consent: disabledConsent(),
-            },
-            error: undefined,
-        });
-    });
-    it("blocks skill publishing when the account-level community switch is off", async () => {
-        const publishSkill = vi.fn(async () => {
-            throw new Error("publish should not be called");
-        });
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            publishSkill,
-            async recordSignal() {
-                throw new Error("not used");
-            },
-        };
-        const store = makeStore(disabledConsent());
-        const host = makeHost({ store, client });
-        await handleCommunityPublishSkill.call(host, {
-            jsonrpc: "2.0",
-            id: "community-publish-off",
-            method: "community.publishSkill",
-            params: skillPublishParams(),
-        });
-        expect(host.responses[0]?.error).toEqual({
-            code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-            message: "Community participation consent is required before publishing shared skills.",
-        });
-        expect(publishSkill).not.toHaveBeenCalled();
-        expect(store.writes).toEqual([]);
-    });
-    it("blocks registry signals when the account-level community switch is off", async () => {
-        const recordSignal = vi.fn(async () => {
-            throw new Error("signal should not be called");
-        });
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            async publishSkill() {
-                throw new Error("not used");
-            },
-            recordSignal,
-        };
-        const store = makeStore(disabledConsent());
-        const host = makeHost({ store, client });
-        await handleCommunityRecordSignal.call(host, {
-            jsonrpc: "2.0",
-            id: "community-signal-off",
-            method: "community.recordSignal",
-            params: {
-                resourceId: "email-ops",
-                event: "success",
-                attribution: "selected",
-                metadata: { source: "desktop" },
-            },
-        });
-        expect(host.responses[0]?.error).toEqual({
-            code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-            message: "Community participation consent is required before sending registry signals.",
-        });
-        expect(recordSignal).not.toHaveBeenCalled();
-        expect(store.writes).toEqual([]);
-    });
-    it("does not queue community writes when the hub is unavailable", async () => {
-        const store = makeStore(enabledConsent());
-        const host = makeHost({ store, client: null });
-        await handleCommunityPublishSkill.call(host, {
-            jsonrpc: "2.0",
-            id: "community-publish-offline",
-            method: "community.publishSkill",
-            params: skillPublishParams(),
-        });
-        await handleCommunityRecordSignal.call(host, {
-            jsonrpc: "2.0",
-            id: "community-signal-offline",
-            method: "community.recordSignal",
-            params: {
-                resourceId: "email-ops",
-                event: "success",
-            },
-        });
-        expect(host.responses).toEqual([
-            {
-                id: "community-publish-offline",
-                result: undefined,
-                error: {
-                    code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-                    message: "Community hub is unavailable.",
-                },
-            },
-            {
-                id: "community-signal-offline",
-                result: undefined,
-                error: {
-                    code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-                    message: "Community hub is unavailable.",
-                },
-            },
-        ]);
-        expect(store.writes).toEqual([]);
-    });
-    it("publishes a shared skill only when method sharing consent is enabled", async () => {
-        const publishSkill = vi.fn(async () => ({
-            resource: {
-                id: "email-ops",
-                type: "skill",
-                title: "Email Ops",
-                summary: "Send and triage email",
-                visibility: "public",
-                latestVersion: null,
-                withdrawn: false,
-                withdrawnAt: null,
-            },
-        }));
-        const client = {
-            async getConsent() {
-                return enabledConsent();
-            },
-            async setConsent() {
-                return enabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            publishSkill,
-            async recordSignal() {
-                throw new Error("not used");
-            },
-        };
-        const store = makeStore(enabledConsent());
-        const host = makeHost({ store, client });
-        await handleCommunityPublishSkill.call(host, {
-            jsonrpc: "2.0",
-            id: "community-publish-on",
-            method: "community.publishSkill",
-            params: skillPublishParams(),
-        });
-        expect(publishSkill).toHaveBeenCalledWith(skillPublishParams());
-        expect(host.responses[0]).toEqual({
-            id: "community-publish-on",
-            result: {
-                ok: true,
-                resource: {
-                    id: "email-ops",
-                    type: "skill",
-                    title: "Email Ops",
-                    summary: "Send and triage email",
-                    visibility: "public",
-                    latestVersion: null,
-                    withdrawn: false,
-                    withdrawnAt: null,
-                },
-            },
-            error: undefined,
-        });
-    });
-    it("records registry signals only when signal consent is enabled", async () => {
-        const recordSignal = vi.fn(async () => ({ accepted: true }));
-        const client = {
-            async getConsent() {
-                return enabledConsent();
-            },
-            async setConsent() {
-                return enabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            async publishSkill() {
-                throw new Error("not used");
-            },
-            recordSignal,
-        };
-        const store = makeStore(enabledConsent());
-        const host = makeHost({ store, client });
-        await handleCommunityRecordSignal.call(host, {
-            jsonrpc: "2.0",
-            id: "community-signal-on",
-            method: "community.recordSignal",
-            params: {
-                resourceId: "email-ops",
-                event: "success",
-                attribution: "selected",
-                metadata: { source: "desktop" },
-            },
-        });
-        expect(recordSignal).toHaveBeenCalledWith({
-            resourceId: "email-ops",
-            event: "success",
-            attribution: "selected",
-            metadata: { source: "desktop" },
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-signal-on",
-            result: {
-                ok: true,
-                accepted: true,
-            },
-            error: undefined,
-        });
-    });
-    it("records community telemetry only when signal consent is enabled", async () => {
-        const recordTelemetry = vi.fn(async () => ({ accepted: true }));
-        const client = {
-            async getConsent() {
-                return enabledConsent();
-            },
-            async setConsent() {
-                return enabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            async publishSkill() {
-                throw new Error("not used");
-            },
-            async recordSignal() {
-                throw new Error("not used");
-            },
-            recordTelemetry,
-            async resolveInstall() {
-                throw new Error("not used");
-            },
-        };
-        const store = makeStore(enabledConsent());
-        const host = makeHost({ store, client });
-        await handleCommunityRecordTelemetry.call(host, {
-            jsonrpc: "2.0",
-            id: "community-telemetry-on",
-            method: "community.recordTelemetry",
-            params: {
-                event: "community.share.generated",
-                metadata: {
-                    surface: "pet-journey",
-                    journeyDay: 12,
-                    content: "raw content must be dropped before egress",
-                    filePath: "C:\\Users\\alice\\.ssh\\id_rsa",
-                    toolCommand: "cat C:\\Users\\alice\\.ssh\\id_rsa",
-                    secret: "sk-test-secret",
-                },
-            },
-        });
-        expect(recordTelemetry).toHaveBeenCalledWith({
-            event: "community.share.generated",
-            metadata: {
-                surface: "pet-journey",
-                journeyDay: 12,
-            },
-        });
-        expect(JSON.stringify(recordTelemetry.mock.calls)).not.toContain("id_rsa");
-        expect(JSON.stringify(recordTelemetry.mock.calls)).not.toContain("raw content");
-        expect(JSON.stringify(recordTelemetry.mock.calls)).not.toContain("sk-test-secret");
-        expect(host.responses[0]).toEqual({
-            id: "community-telemetry-on",
-            result: {
-                ok: true,
-                accepted: true,
-            },
-            error: undefined,
-        });
-    });
-    it("refuses to enable community participation without a hub client", async () => {
-        const store = makeStore();
-        const host = makeHost({ store, client: null });
-        await handleCommunitySetConsent.call(host, {
-            jsonrpc: "2.0",
-            id: "community-2",
-            method: "community.setConsent",
-            params: { enabled: true },
-        });
-        expect(host.responses[0]?.error).toEqual({
-            code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-            message: "Community hub is unavailable; consent was not changed.",
-        });
-        expect(store.writes).toEqual([]);
-    });
-    it("stores the server-confirmed consent after a successful hub update", async () => {
-        const store = makeStore();
-        const remoteConsent = {
-            enabled: true,
-            methodSharingEnabled: true,
-            signalsEnabled: true,
-            encounterEnabled: true,
-            remoteSynced: true,
-        };
-        const client = {
-            async getConsent() {
-                return remoteConsent;
-            },
-            async setConsent(input) {
-                expect(input).toEqual({ enabled: true });
-                return remoteConsent;
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-        };
-        const host = makeHost({ store, client });
-        await handleCommunitySetConsent.call(host, {
-            jsonrpc: "2.0",
-            id: "community-3",
-            method: "community.setConsent",
-            params: { enabled: true },
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-3",
-            result: {
-                ok: true,
-                remoteAvailable: true,
-                consent: remoteConsent,
-            },
-            error: undefined,
-        });
-        expect(store.writes).toEqual([remoteConsent]);
-    });
-    it("lists shared resources through the community hub client", async () => {
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [{
-                        id: "email-ops",
-                        type: "skill",
-                        title: "Email Ops",
-                        summary: "s",
-                        visibility: "public",
-                        latestVersion: "1.0.0",
-                        withdrawn: false,
-                        withdrawnAt: null,
-                    }];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-        };
-        const host = makeHost({ client });
-        await handleCommunityListShared.call(host, {
-            jsonrpc: "2.0",
-            id: "community-4",
-            method: "community.listShared",
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-4",
-            result: {
-                ok: true,
-                resources: [{
-                        id: "email-ops",
-                        type: "skill",
-                        title: "Email Ops",
-                        summary: "s",
-                        visibility: "public",
-                        latestVersion: "1.0.0",
-                        withdrawn: false,
-                        withdrawnAt: null,
-                    }],
-            },
-            error: undefined,
-        });
-    });
-    it("matches registry resources with a top-1..3 O(1) response contract", async () => {
-        const matchRegistry = vi.fn(async () => [
-            {
-                id: "email-ops",
-                type: "skill",
-                title: "Email Ops",
-                summary: "Send and triage email",
-                capabilityTags: ["email", "triage"],
-                sourceTier: "official",
-                trustStage: "trusted",
-                resourceRiskTier: "R0",
-                effectiveRiskTier: "R0",
-                latestVersion: "1.0.0",
-                canonical: true,
-            },
-        ]);
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-            matchRegistry,
-        };
-        const host = makeHost({ client });
-        await handleCommunityMatchRegistry.call(host, {
-            jsonrpc: "2.0",
-            id: "community-match",
-            method: "community.matchRegistry",
-            params: { intent: "triage email", topK: 2 },
-        });
-        expect(matchRegistry).toHaveBeenCalledWith({ intent: "triage email", topK: 2 });
-        expect(host.responses[0]).toEqual({
-            id: "community-match",
-            result: {
-                ok: true,
-                matches: [{
-                        id: "email-ops",
-                        type: "skill",
-                        title: "Email Ops",
-                        summary: "Send and triage email",
-                        capabilityTags: ["email", "triage"],
-                        sourceTier: "official",
-                        trustStage: "trusted",
-                        resourceRiskTier: "R0",
-                        effectiveRiskTier: "R0",
-                        latestVersion: "1.0.0",
-                        canonical: true,
-                    }],
-            },
-            error: undefined,
-        });
-    });
-    it("rejects registry discovery requests that try to browse more than top-3", async () => {
-        const matchRegistry = vi.fn();
-        const host = makeHost({
-            client: {
-                async getConsent() {
-                    return disabledConsent();
-                },
-                async setConsent() {
-                    return disabledConsent();
-                },
-                async listSharedResources() {
-                    return [];
-                },
-                async withdrawSharedResource() {
-                    throw new Error("not used");
-                },
-                async withdrawSharedResources() {
-                    throw new Error("not used");
-                },
-                async listNotices() {
-                    return [];
-                },
-                async markNoticeRead() {
-                    throw new Error("not used");
-                },
-                ...unusedCommunityWriteMethods(),
-                matchRegistry,
-            },
-        });
-        await handleCommunityMatchRegistry.call(host, {
-            jsonrpc: "2.0",
-            id: "community-match-invalid",
-            method: "community.matchRegistry",
-            params: { intent: "show me everything", topK: 50 },
-        });
-        expect(matchRegistry).not.toHaveBeenCalled();
-        expect(host.responses[0]).toMatchObject({
-            id: "community-match-invalid",
-            error: {
-                code: AGENT_RPC_ERROR_CODES.INVALID_PARAMS,
-            },
-        });
-    });
-    it("requires explicit install consent before resolving a community install", async () => {
-        const resolveInstall = vi.fn(async () => ({
-            id: "crm-skill",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "quarantine",
-            reviewStatus: "approved",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R0",
-            requires: [],
-            dependencies: [],
-            version: "1.0.0",
-            checksum: "sha256:crm",
-            sizeBytes: 123,
-            downloadUrl: "https://oss.example/registry/crm-skill/1.0.0.tar.gz",
-            manifest: { schema_version: 15, kind: "inert", requires: [] },
-        }));
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-            resolveInstall,
-        };
-        const host = makeHost({ client });
-        await getResolveInstallHandler().call(host, {
-            jsonrpc: "2.0",
-            id: "community-install-no-consent",
-            method: "community.resolveInstall",
-            params: { resourceId: "crm-skill" },
-        });
-        expect(resolveInstall).not.toHaveBeenCalled();
-        expect(host.responses[0]?.error).toMatchObject({
-            code: AGENT_RPC_ERROR_CODES.INVALID_PARAMS,
-            message: "explicitInstallConsent=true is required before resolving a community install.",
-        });
-    });
-    it("hides high-risk install resolutions until one-shot high-risk consent is supplied", async () => {
-        const highRiskResolution = {
-            id: "crm-skill",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "trusted",
-            reviewStatus: "approved",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R3",
-            requires: ["crm-mcp"],
-            dependencies: [{
-                    id: "crm-mcp",
-                    type: "mcp",
-                    kind: "endpoint",
-                    sourceTier: "official",
-                    trustStage: "trusted",
-                    reviewStatus: "approved",
-                    resourceRiskTier: "R3",
-                    effectiveRiskTier: "R3",
-                    requires: [],
-                    dependencies: [],
-                    version: "1.0.0",
-                    checksum: "sha256:mcp",
-                    sizeBytes: 456,
-                    downloadUrl: "https://oss.example/registry/crm-mcp/1.0.0.tar.gz",
-                    manifest: { schema_version: 15, kind: "endpoint", requires: [] },
-                }],
-            version: "1.0.0",
-            checksum: "sha256:crm",
-            sizeBytes: 123,
-            downloadUrl: "https://oss.example/registry/crm-skill/1.0.0.tar.gz",
-            manifest: { schema_version: 15, kind: "inert", requires: ["crm-mcp"] },
-        };
-        const resolveInstall = vi.fn(async () => highRiskResolution);
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-            resolveInstall,
-        };
-        const host = makeHost({ client });
-        await getResolveInstallHandler().call(host, {
-            jsonrpc: "2.0",
-            id: "community-install-high-risk-hidden",
-            method: "community.resolveInstall",
-            params: {
-                resourceId: "crm-skill",
-                explicitInstallConsent: true,
-            },
-        });
-        expect(resolveInstall).toHaveBeenCalledWith("crm-skill", undefined);
-        expect(host.responses[0]).toEqual({
-            id: "community-install-high-risk-hidden",
-            result: undefined,
-            error: {
-                code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-                message: "Explicit high-risk consent is required before exposing R3 community install resolution.",
-                data: {
-                    resourceRiskTier: "R0",
-                    effectiveRiskTier: "R3",
-                    requiresExplicitHighRiskConsent: true,
-                },
-            },
-        });
-    });
-    it("returns install resolution with dependency risk closure after explicit consent", async () => {
-        const resolution = {
-            id: "crm-skill",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "trusted",
-            reviewStatus: "approved",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R3",
-            requires: ["crm-mcp"],
-            dependencies: [{
-                    id: "crm-mcp",
-                    type: "mcp",
-                    kind: "endpoint",
-                    sourceTier: "official",
-                    trustStage: "trusted",
-                    reviewStatus: "approved",
-                    resourceRiskTier: "R3",
-                    effectiveRiskTier: "R3",
-                    requires: [],
-                    dependencies: [],
-                    version: "1.0.0",
-                    checksum: "sha256:mcp",
-                    sizeBytes: 456,
-                    downloadUrl: "https://oss.example/registry/crm-mcp/1.0.0.tar.gz",
-                    manifest: { schema_version: 15, kind: "endpoint", requires: [] },
-                }],
-            version: "1.0.0",
-            checksum: "sha256:crm",
-            sizeBytes: 123,
-            downloadUrl: "https://oss.example/registry/crm-skill/1.0.0.tar.gz",
-            manifest: { schema_version: 15, kind: "inert", requires: ["crm-mcp"] },
-        };
-        const resolveInstall = vi.fn(async () => resolution);
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-            resolveInstall,
-        };
-        const host = makeHost({ client });
-        await getResolveInstallHandler().call(host, {
-            jsonrpc: "2.0",
-            id: "community-install-confirmed",
-            method: "community.resolveInstall",
-            params: {
-                resourceId: "crm-skill",
-                version: "1.0.0",
-                explicitInstallConsent: true,
-                explicitHighRiskConsent: true,
-            },
-        });
-        expect(resolveInstall).toHaveBeenCalledWith("crm-skill", "1.0.0");
-        expect(host.responses[0]).toEqual({
-            id: "community-install-confirmed",
-            result: {
-                ok: true,
-                install: resolution,
-            },
-            error: undefined,
-        });
-    });
-    it("requires explicit high-risk consent before installing a resource with an R2/R3 dependency closure", async () => {
-        const previousHome = process.env.QLOGICAGENT_HOME;
-        const previousOwner = process.env.QLOGIC_LLMROUTER_USER_ID;
-        const home = await fs.mkdtemp(path.join(tmpdir(), "qlogic-community-install-high-risk-"));
-        const highRiskResolution = {
-            id: "crm-skill",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "trusted",
-            reviewStatus: "approved",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R3",
-            requires: ["crm-mcp"],
-            dependencies: [{
-                    id: "crm-mcp",
-                    type: "mcp",
-                    kind: "endpoint",
-                    sourceTier: "official",
-                    trustStage: "trusted",
-                    reviewStatus: "approved",
-                    resourceRiskTier: "R3",
-                    effectiveRiskTier: "R3",
-                    requires: [],
-                    dependencies: [],
-                    version: "1.0.0",
-                    checksum: "sha256:mcp",
-                    sizeBytes: 456,
-                    downloadUrl: "https://oss.example/registry/crm-mcp/1.0.0.tar.gz",
-                    manifest: { schema_version: 15, kind: "endpoint", requires: [] },
-                }],
-            version: "1.0.0",
-            checksum: "sha256:crm",
-            sizeBytes: 123,
-            downloadUrl: "https://oss.example/registry/crm-skill/1.0.0.tar.gz",
-            manifest: { schema_version: 15, kind: "inert", requires: ["crm-mcp"] },
-        };
-        const resolveInstall = vi.fn(async () => highRiskResolution);
-        const fetchMock = vi.fn(async () => new Response(Buffer.from("pkg")));
-        try {
-            process.env.QLOGICAGENT_HOME = home;
-            process.env.QLOGIC_LLMROUTER_USER_ID = "user/alice";
-            vi.stubGlobal("fetch", fetchMock);
-            const client = {
-                async getConsent() {
-                    return enabledConsent();
-                },
-                async setConsent() {
-                    return enabledConsent();
-                },
-                async listSharedResources() {
-                    return [];
-                },
-                async withdrawSharedResource() {
-                    throw new Error("not used");
-                },
-                async withdrawSharedResources() {
-                    throw new Error("not used");
-                },
-                async listNotices() {
-                    return [];
-                },
-                async markNoticeRead() {
-                    throw new Error("not used");
-                },
-                async publishSkill() {
-                    throw new Error("not used");
-                },
-                async recordSignal() {
-                    throw new Error("not used");
-                },
-                resolveInstall,
-            };
-            const host = makeHost({ store: makeStore(enabledConsent()), client });
-            await getInstallResourceHandler().call(host, {
-                jsonrpc: "2.0",
-                id: "community-install-high-risk-hidden",
-                method: "community.installResource",
-                params: {
-                    resourceId: "crm-skill",
-                    explicitInstallConsent: true,
-                },
-            });
-            expect(resolveInstall).toHaveBeenCalledWith("crm-skill", undefined);
-            expect(fetchMock).not.toHaveBeenCalled();
-            expect(host.responses[0]).toEqual({
-                id: "community-install-high-risk-hidden",
-                result: undefined,
-                error: {
-                    code: AGENT_RPC_ERROR_CODES.INTERNAL_ERROR,
-                    message: "Explicit high-risk consent is required before exposing R3 community install resolution.",
-                    data: {
-                        resourceRiskTier: "R0",
-                        effectiveRiskTier: "R3",
-                        requiresExplicitHighRiskConsent: true,
-                    },
-                },
-            });
-        }
-        finally {
-            vi.unstubAllGlobals();
-            if (previousHome === undefined) {
-                delete process.env.QLOGICAGENT_HOME;
-            }
-            else {
-                process.env.QLOGICAGENT_HOME = previousHome;
-            }
-            if (previousOwner === undefined) {
-                delete process.env.QLOGIC_LLMROUTER_USER_ID;
-            }
-            else {
-                process.env.QLOGIC_LLMROUTER_USER_ID = previousOwner;
-            }
-            await fs.rm(home, { recursive: true, force: true });
-        }
-    });
-    it("installs a verified R0 skill package into the active owner profile and records the installed signal", async () => {
-        const previousHome = process.env.QLOGICAGENT_HOME;
-        const previousOwner = process.env.QLOGIC_LLMROUTER_USER_ID;
-        const home = await fs.mkdtemp(path.join(tmpdir(), "qlogic-community-install-"));
-        const skillMd = [
-            "---",
-            "name: email-ops",
-            "description: Send and triage email",
-            "version: 1.0.0",
-            "---",
-            "Use this method to triage an inbox.",
-        ].join("\n");
-        const pkg = makeSkillPackage(skillMd);
-        const checksum = createHash("sha256").update(pkg).digest("hex");
-        const resolveInstall = vi.fn(async () => ({
-            id: "email-ops",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "quarantine",
-            reviewStatus: "approved",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R0",
-            requires: [],
-            dependencies: [],
-            version: "1.0.0",
-            checksum,
-            sizeBytes: pkg.length,
-            downloadUrl: "https://oss.example/registry/email-ops/1.0.0.tar.gz",
-            manifest: {
-                schema_version: 15,
-                kind: "inert",
-                name: "Email Ops",
-                summary: "Send and triage email",
-                description: "Reusable skill for triaging email.",
-                triggers: ["email"],
-                entry: "SKILL.md",
-            },
-        }));
-        const recordSignal = vi.fn(async () => ({ accepted: true }));
-        const fetchMock = vi.fn(async () => new Response(pkg));
-        try {
-            process.env.QLOGICAGENT_HOME = home;
-            process.env.QLOGIC_LLMROUTER_USER_ID = "user/alice";
-            vi.stubGlobal("fetch", fetchMock);
-            const client = {
-                async getConsent() {
-                    return enabledConsent();
-                },
-                async setConsent() {
-                    return enabledConsent();
-                },
-                async listSharedResources() {
-                    return [];
-                },
-                async withdrawSharedResource() {
-                    throw new Error("not used");
-                },
-                async withdrawSharedResources() {
-                    throw new Error("not used");
-                },
-                async listNotices() {
-                    return [];
-                },
-                async markNoticeRead() {
-                    throw new Error("not used");
-                },
-                async publishSkill() {
-                    throw new Error("not used");
-                },
-                recordSignal,
-                resolveInstall,
-            };
-            const store = makeStore(enabledConsent());
-            const host = makeHost({ store, client });
-            await getInstallResourceHandler().call(host, {
-                jsonrpc: "2.0",
-                id: "community-install-skill",
-                method: "community.installResource",
-                params: {
-                    resourceId: "email-ops",
-                    explicitInstallConsent: true,
-                },
-            });
-            const skillPath = path.join(home, "profiles", "user%2Falice", "skills", "email-ops", "SKILL.md");
-            const lifecyclePath = path.join(home, "profiles", "user%2Falice", "skill-lifecycle.json");
-            expect(host.responses[0]).toMatchObject({
-                id: "community-install-skill",
-                result: {
-                    ok: true,
-                    installed: {
-                        resourceId: "email-ops",
-                        version: "1.0.0",
-                        skillName: "email-ops",
-                    },
-                },
-            });
-            expect(fetchMock).toHaveBeenCalledWith("https://oss.example/registry/email-ops/1.0.0.tar.gz", expect.objectContaining({ method: "GET" }));
-            expect(await fs.readFile(skillPath, "utf8")).toBe(skillMd);
-            const lifecycle = JSON.parse(await fs.readFile(lifecyclePath, "utf8"));
-            expect(lifecycle.records["email-ops"]).toMatchObject({
-                source: "installed",
-                state: "active",
-                registryResourceId: "email-ops",
-                registryVersion: "1.0.0",
-                registrySourceTier: "community",
-                registryRiskTier: "R0",
-                registryEffectiveRiskTier: "R0",
-            });
-            expect(recordSignal).toHaveBeenCalledWith({
-                resourceId: "email-ops",
-                event: "installed",
-                metadata: { version: "1.0.0", source: "community-install" },
-            });
-        }
-        finally {
-            vi.unstubAllGlobals();
-            if (previousHome === undefined) {
-                delete process.env.QLOGICAGENT_HOME;
-            }
-            else {
-                process.env.QLOGICAGENT_HOME = previousHome;
-            }
-            if (previousOwner === undefined) {
-                delete process.env.QLOGIC_LLMROUTER_USER_ID;
-            }
-            else {
-                process.env.QLOGIC_LLMROUTER_USER_ID = previousOwner;
-            }
-            await fs.rm(home, { recursive: true, force: true });
-        }
-    });
-    it("rejects unreviewed community install resolutions before downloading packages", async () => {
-        const previousHome = process.env.QLOGICAGENT_HOME;
-        const previousOwner = process.env.QLOGIC_LLMROUTER_USER_ID;
-        const home = await fs.mkdtemp(path.join(tmpdir(), "qlogic-community-install-gate-"));
-        const skillMd = [
-            "---",
-            "name: unreviewed-skill",
-            "description: Should stay gated until review",
-            "version: 1.0.0",
-            "---",
-            "Use this method only after registry review.",
-        ].join("\n");
-        const pkg = makeSkillPackage(skillMd);
-        const checksum = createHash("sha256").update(pkg).digest("hex");
-        const resolveInstall = vi.fn(async () => ({
-            id: "unreviewed-skill",
-            type: "skill",
-            kind: "inert",
-            sourceTier: "community",
-            trustStage: "quarantine",
-            reviewStatus: "pending",
-            resourceRiskTier: "R0",
-            effectiveRiskTier: "R0",
-            requires: [],
-            dependencies: [],
-            version: "1.0.0",
-            checksum,
-            sizeBytes: pkg.length,
-            downloadUrl: "https://oss.example/registry/unreviewed-skill/1.0.0.tar.gz",
-            manifest: {
-                schema_version: 15,
-                kind: "inert",
-                name: "Unreviewed Skill",
-                summary: "Should stay gated until review.",
-                description: "Reusable skill still waiting for review.",
-                triggers: ["review"],
-                entry: "SKILL.md",
-            },
-        }));
-        const fetchMock = vi.fn(async () => new Response(pkg));
-        try {
-            process.env.QLOGICAGENT_HOME = home;
-            process.env.QLOGIC_LLMROUTER_USER_ID = "user/alice";
-            vi.stubGlobal("fetch", fetchMock);
-            const client = {
-                async getConsent() {
-                    return enabledConsent();
-                },
-                async setConsent() {
-                    return enabledConsent();
-                },
-                async listSharedResources() {
-                    return [];
-                },
-                async withdrawSharedResource() {
-                    throw new Error("not used");
-                },
-                async withdrawSharedResources() {
-                    throw new Error("not used");
-                },
-                async listNotices() {
-                    return [];
-                },
-                async markNoticeRead() {
-                    throw new Error("not used");
-                },
-                async publishSkill() {
-                    throw new Error("not used");
-                },
-                async recordSignal() {
-                    throw new Error("not used");
-                },
-                resolveInstall,
-            };
-            const host = makeHost({ store: makeStore(enabledConsent()), client });
-            await getInstallResourceHandler().call(host, {
-                jsonrpc: "2.0",
-                id: "community-install-unreviewed",
-                method: "community.installResource",
-                params: {
-                    resourceId: "unreviewed-skill",
-                    explicitInstallConsent: true,
-                },
-            });
-            expect(fetchMock).not.toHaveBeenCalled();
-            expect(host.responses[0]).toMatchObject({
-                id: "community-install-unreviewed",
-                error: {
-                    message: expect.stringMatching(/official|reviewed|approved|trust/i),
-                },
-            });
-        }
-        finally {
-            vi.unstubAllGlobals();
-            if (previousHome === undefined) {
-                delete process.env.QLOGICAGENT_HOME;
-            }
-            else {
-                process.env.QLOGICAGENT_HOME = previousHome;
-            }
-            if (previousOwner === undefined) {
-                delete process.env.QLOGIC_LLMROUTER_USER_ID;
-            }
-            else {
-                process.env.QLOGIC_LLMROUTER_USER_ID = previousOwner;
-            }
-            await fs.rm(home, { recursive: true, force: true });
-        }
-    });
-    it("lists local auto-publish audit entries from the active owner profile newest first", async () => {
-        const previousHome = process.env.QLOGICAGENT_HOME;
-        const previousOwner = process.env.QLOGIC_LLMROUTER_USER_ID;
-        const home = await fs.mkdtemp(path.join(tmpdir(), "qlogic-community-audit-"));
-        try {
-            process.env.QLOGICAGENT_HOME = home;
-            process.env.QLOGIC_LLMROUTER_USER_ID = "user/alice";
-            const profileDir = path.join(home, "profiles", "user%2Falice");
-            await fs.mkdir(profileDir, { recursive: true });
-            await fs.writeFile(path.join(profileDir, "community-publish-audit.jsonl"), [
-                JSON.stringify({
-                    eventTurnId: "turn-old",
-                    skillName: "Inbox Cleanup",
-                    decision: "skipped",
-                    reason: "not worth sharing",
-                    createdAt: "2026-01-01T00:00:00.000Z",
-                }),
-                "{not-json",
-                JSON.stringify({
-                    eventTurnId: "turn-new",
-                    skillName: "Research Brief",
-                    decision: "published",
-                    reason: "eligible",
-                    resourceId: "research-brief",
-                    createdAt: "2026-01-02T00:00:00.000Z",
-                }),
-            ].join("\n"), "utf8");
-            const host = makeHost();
-            const handler = communityHandlers.handleCommunityListPublishAudit;
-            expect(handler).toBeTypeOf("function");
-            await handler.call(host, {
-                jsonrpc: "2.0",
-                id: "community-audit",
-                method: "community.listPublishAudit",
-                params: { limit: 10 },
-            });
-            expect(host.responses[0]).toEqual({
-                id: "community-audit",
-                result: {
-                    ok: true,
-                    entries: [
-                        {
-                            eventTurnId: "turn-new",
-                            skillName: "Research Brief",
-                            decision: "published",
-                            reason: "eligible",
-                            resourceId: "research-brief",
-                            createdAt: "2026-01-02T00:00:00.000Z",
-                        },
-                        {
-                            eventTurnId: "turn-old",
-                            skillName: "Inbox Cleanup",
-                            decision: "skipped",
-                            reason: "not worth sharing",
-                            createdAt: "2026-01-01T00:00:00.000Z",
-                        },
-                    ],
-                },
-                error: undefined,
-            });
-        }
-        finally {
-            if (previousHome === undefined) {
-                delete process.env.QLOGICAGENT_HOME;
-            }
-            else {
-                process.env.QLOGICAGENT_HOME = previousHome;
-            }
-            if (previousOwner === undefined) {
-                delete process.env.QLOGIC_LLMROUTER_USER_ID;
-            }
-            else {
-                process.env.QLOGIC_LLMROUTER_USER_ID = previousOwner;
-            }
-            await fs.rm(home, { recursive: true, force: true });
-        }
-    });
-    it("withdraws a shared resource through the community hub client", async () => {
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource(resourceId, reason) {
-                expect(resourceId).toBe("email-ops");
-                expect(reason).toBe("user requested");
-                return {
-                    id: "email-ops",
-                    type: "skill",
-                    title: "Email Ops",
-                    summary: "s",
-                    visibility: "public",
-                    latestVersion: "1.0.0",
-                    withdrawn: true,
-                    withdrawnAt: "2026-01-01T00:00:00.000Z",
-                };
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-        };
-        const host = makeHost({ client });
-        await handleCommunityWithdrawShared.call(host, {
-            jsonrpc: "2.0",
-            id: "community-5",
-            method: "community.withdrawShared",
-            params: { resourceId: "email-ops", reason: "user requested" },
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-5",
-            result: {
-                ok: true,
-                resource: {
-                    id: "email-ops",
-                    type: "skill",
-                    title: "Email Ops",
-                    summary: "s",
-                    visibility: "public",
-                    latestVersion: "1.0.0",
-                    withdrawn: true,
-                    withdrawnAt: "2026-01-01T00:00:00.000Z",
-                },
-            },
-            error: undefined,
-        });
-    });
-    it("bulk withdraws shared resources through the community hub client", async () => {
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources(reason) {
-                expect(reason).toBe("leaving community");
-                return [{
-                        id: "email-ops",
-                        type: "skill",
-                        title: "Email Ops",
-                        summary: "s",
-                        visibility: "public",
-                        latestVersion: "1.0.0",
-                        withdrawn: true,
-                        withdrawnAt: "2026-01-01T00:00:00.000Z",
-                    }];
-            },
-            async listNotices() {
-                return [];
-            },
-            async markNoticeRead() {
-                throw new Error("not used");
-            },
-            ...unusedCommunityWriteMethods(),
-        };
-        const host = makeHost({ client });
-        await handleCommunityWithdrawAllShared.call(host, {
-            jsonrpc: "2.0",
-            id: "community-bulk",
-            method: "community.withdrawAllShared",
-            params: { reason: "leaving community" },
-        });
-        expect(host.responses[0]).toEqual({
-            id: "community-bulk",
-            result: {
-                ok: true,
-                resources: [{
-                        id: "email-ops",
-                        type: "skill",
-                        title: "Email Ops",
-                        summary: "s",
-                        visibility: "public",
-                        latestVersion: "1.0.0",
-                        withdrawn: true,
-                        withdrawnAt: "2026-01-01T00:00:00.000Z",
-                    }],
-            },
-            error: undefined,
-        });
-    });
-    it("lists registry notices and marks one read through the community hub client", async () => {
-        const client = {
-            async getConsent() {
-                return disabledConsent();
-            },
-            async setConsent() {
-                return disabledConsent();
-            },
-            async listSharedResources() {
-                return [];
-            },
-            async withdrawSharedResource() {
-                throw new Error("not used");
-            },
-            async withdrawSharedResources() {
-                throw new Error("not used");
-            },
-            async listNotices(input) {
-                expect(input).toEqual({ includeRead: true });
-                return [{
-                        id: 7,
-                        resourceId: "email-ops",
-                        resourceType: "skill",
-                        title: "Email Ops",
-                        event: "withdrawn",
-                        version: "1.0.0",
-                        reason: "unsafe",
-                        read: false,
-                        createdAt: "2026-01-01T00:00:00.000Z",
-                        readAt: null,
-                    }];
-            },
-            async markNoticeRead(noticeId) {
-                expect(noticeId).toBe(7);
-                return {
-                    id: 7,
-                    resourceId: "email-ops",
-                    resourceType: "skill",
-                    title: "Email Ops",
-                    event: "withdrawn",
-                    version: "1.0.0",
-                    reason: "unsafe",
-                    read: true,
-                    createdAt: "2026-01-01T00:00:00.000Z",
-                    readAt: "2026-01-01T00:01:00.000Z",
-                };
-            },
-            ...unusedCommunityWriteMethods(),
-        };
-        const host = makeHost({ client });
-        await handleCommunityListNotices.call(host, {
-            jsonrpc: "2.0",
-            id: "community-6",
-            method: "community.listNotices",
-            params: { includeRead: true },
-        });
-        await handleCommunityMarkNoticeRead.call(host, {
-            jsonrpc: "2.0",
-            id: "community-7",
-            method: "community.markNoticeRead",
-            params: { noticeId: 7 },
-        });
-        expect(host.responses).toEqual([
-            {
-                id: "community-6",
-                result: {
-                    ok: true,
-                    notices: [{
-                            id: 7,
-                            resourceId: "email-ops",
-                            resourceType: "skill",
-                            title: "Email Ops",
-                            event: "withdrawn",
-                            version: "1.0.0",
-                            reason: "unsafe",
-                            read: false,
-                            createdAt: "2026-01-01T00:00:00.000Z",
-                            readAt: null,
-                        }],
-                },
-                error: undefined,
-            },
-            {
-                id: "community-7",
-                result: {
-                    ok: true,
-                    notice: {
-                        id: 7,
-                        resourceId: "email-ops",
-                        resourceType: "skill",
-                        title: "Email Ops",
-                        event: "withdrawn",
-                        version: "1.0.0",
-                        reason: "unsafe",
-                        read: true,
-                        createdAt: "2026-01-01T00:00:00.000Z",
-                        readAt: "2026-01-01T00:01:00.000Z",
-                    },
-                },
-                error: undefined,
-            },
-        ]);
-    });
-});