relay-ide 0.1.0

package/dist/test/org-dashboard.test.js

@@ -0,0 +1,349 @@
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import { createOrgDashboardRouter, } from '../server/org-dashboard.js';
+import { saveConfig, DEFAULTS } from '../server/config.js';
+let tmpDir;
+let configPath;
+let server;
+let baseUrl;
+// A workspace path we can point git remote mocks at
+const WORKSPACE_PATH_A = '/fake/workspace/repo-a';
+const WORKSPACE_PATH_B = '/fake/workspace/repo-b';
+/**
+ * Creates a mock execAsync that routes calls based on the command.
+ * - `git remote get-url origin` → returns configured remote URL or throws
+ * - `gh api user ...` → returns configured user login or throws
+ * - `gh api search/issues ...` → returns configured search response or throws
+ */
+function makeMockExec(opts) {
+    return async (cmd, args, options) => {
+        const command = cmd;
+        const argv = args;
+        if (command === 'git' && argv[0] === 'remote') {
+            const cwd = options.cwd ?? '';
+            const remote = opts.remotes?.[cwd];
+            if (remote)
+                return { stdout: remote + '\n', stderr: '' };
+            throw Object.assign(new Error('not a git repository'), { code: 128 });
+        }
+        if (command === 'gh' && argv[0] === 'api' && argv[1] === 'user') {
+            if (opts.userError)
+                throw opts.userError;
+            const login = opts.userLogin ?? 'testuser';
+            return { stdout: login + '\n', stderr: '' };
+        }
+        if (command === 'gh' &&
+            argv[0] === 'api' &&
+            argv[1]?.startsWith('search/issues')) {
+            if (opts.searchError)
+                throw opts.searchError;
+            const items = opts.searchItems ?? [];
+            return { stdout: JSON.stringify({ items }), stderr: '' };
+        }
+        throw new Error(`Unexpected exec call: ${command} ${argv.join(' ')}`);
+    };
+}
+/**
+ * Builds a minimal GH search item for a given owner/repo and user.
+ */
+function makeSearchItem(overrides) {
+    const { ownerRepo, number = 1, title = 'Test PR', author = 'testuser', role = 'author', currentUser = 'testuser', } = overrides;
+    return {
+        number,
+        title,
+        html_url: `https://github.com/${ownerRepo}/pull/${number}`,
+        state: 'open',
+        user: { login: author },
+        pull_request: { head: { ref: 'feat/branch' }, base: { ref: 'main' } },
+        updated_at: '2026-03-21T00:00:00Z',
+        requested_reviewers: role === 'reviewer' ? [{ login: currentUser }] : [],
+        repository_url: `https://api.github.com/repos/${ownerRepo}`,
+    };
+}
+function startServer(execAsyncFn) {
+    return new Promise((resolve) => {
+        const app = express();
+        app.use(express.json());
+        // Cast through unknown: the mock satisfies the runtime contract but the
+        // overloaded promisify types don't align across module instances.
+        const deps = {
+            configPath,
+            execAsync: execAsyncFn,
+        };
+        app.use('/org-dashboard', createOrgDashboardRouter(deps));
+        server = app.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (typeof addr === 'object' && addr) {
+                baseUrl = `http://127.0.0.1:${addr.port}`;
+            }
+            resolve();
+        });
+    });
+}
+function stopServer() {
+    return new Promise((resolve) => {
+        if (server)
+            server.close(() => resolve());
+        else
+            resolve();
+    });
+}
+async function getPrs() {
+    const res = await fetch(`${baseUrl}/org-dashboard/prs`);
+    return res.json();
+}
+before(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'org-dashboard-test-'));
+    configPath = path.join(tmpDir, 'config.json');
+});
+after(async () => {
+    await stopServer();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+// Each test gets a fresh server with its own router (and thus its own cache).
+// We stop/start the server around each test to reset the in-router cache state.
+test('returns prs filtered to workspace repos', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A, WORKSPACE_PATH_B],
+    });
+    const exec = makeMockExec({
+        remotes: {
+            [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git',
+            [WORKSPACE_PATH_B]: 'git@github.com:myorg/repo-b.git',
+        },
+        userLogin: 'testuser',
+        searchItems: [
+            // Matches WORKSPACE_PATH_A
+            makeSearchItem({
+                ownerRepo: 'myorg/repo-a',
+                number: 10,
+                author: 'testuser',
+            }),
+            // Matches WORKSPACE_PATH_B
+            makeSearchItem({
+                ownerRepo: 'myorg/repo-b',
+                number: 20,
+                author: 'testuser',
+            }),
+            // Not in any workspace — should be excluded
+            makeSearchItem({
+                ownerRepo: 'myorg/other-repo',
+                number: 30,
+                author: 'testuser',
+            }),
+        ],
+    });
+    await startServer(exec);
+    const data = await getPrs();
+    assert.equal(data.error, undefined, `Unexpected error: ${data.error}`);
+    assert.equal(data.prs.length, 2, 'Should return only the 2 workspace-matched PRs');
+    const numbers = data.prs.map((p) => p.number).sort((a, b) => a - b);
+    assert.deepEqual(numbers, [10, 20]);
+    // Verify repoPath is attached
+    const pr10 = data.prs.find((p) => p.number === 10);
+    assert.equal(pr10?.repoPath, WORKSPACE_PATH_A);
+});
+test('returns gh_not_in_path error when gh not found', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A],
+    });
+    const notFoundError = Object.assign(new Error('spawn gh ENOENT'), {
+        code: 'ENOENT',
+    });
+    const exec = makeMockExec({
+        remotes: { [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git' },
+        userError: notFoundError,
+    });
+    await startServer(exec);
+    const data = await getPrs();
+    assert.equal(data.error, 'gh_not_in_path');
+    assert.equal(data.prs.length, 0);
+});
+test('returns gh_not_authenticated error', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A],
+    });
+    const authError = new Error('You are not logged into any GitHub hosts. Run gh auth login to authenticate.');
+    const exec = makeMockExec({
+        remotes: { [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git' },
+        userError: authError,
+    });
+    await startServer(exec);
+    const data = await getPrs();
+    assert.equal(data.error, 'gh_not_authenticated');
+    assert.equal(data.prs.length, 0);
+});
+test('returns empty prs with no_workspaces error when workspaces is empty', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [],
+    });
+    // execAsync should never be called here — pass a mock that always throws to
+    // verify the early-return path triggers before any exec
+    const exec = makeMockExec({});
+    await startServer(exec);
+    const data = await getPrs();
+    assert.equal(data.error, 'no_workspaces');
+    assert.equal(data.prs.length, 0);
+});
+test('detects reviewer role when current user is in requested_reviewers but not the author', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A],
+    });
+    // PR authored by someone else; testuser is a requested reviewer
+    const reviewerItem = makeSearchItem({
+        ownerRepo: 'myorg/repo-a',
+        number: 42,
+        title: 'Review me',
+        author: 'otheruser',
+        role: 'reviewer',
+        currentUser: 'testuser',
+    });
+    const exec = makeMockExec({
+        remotes: { [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git' },
+        userLogin: 'testuser',
+        searchItems: [reviewerItem],
+    });
+    await startServer(exec);
+    const data = await getPrs();
+    assert.equal(data.error, undefined, `Unexpected error: ${data.error}`);
+    assert.equal(data.prs.length, 1, 'Should return the reviewer PR');
+    const pr = data.prs[0];
+    assert.equal(pr?.number, 42);
+    assert.equal(pr?.role, 'reviewer', 'Role should be reviewer');
+    assert.equal(pr?.author, 'otheruser', 'Author should be otheruser, not the current user');
+});
+test('caches results within TTL — exec called only once for two requests', async () => {
+    await stopServer();
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A],
+    });
+    let searchCallCount = 0;
+    // Wrap makeMockExec with a counter on the search path
+    const baseExec = makeMockExec({
+        remotes: { [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git' },
+        userLogin: 'testuser',
+        searchItems: [
+            makeSearchItem({
+                ownerRepo: 'myorg/repo-a',
+                number: 1,
+                author: 'testuser',
+            }),
+        ],
+    });
+    const countingExec = async (...args) => {
+        const [cmd, argv] = args;
+        if (cmd === 'gh' &&
+            typeof argv[1] === 'string' &&
+            argv[1].startsWith('search/issues')) {
+            searchCallCount++;
+        }
+        return baseExec(...args);
+    };
+    await startServer(countingExec);
+    // First request — populates cache
+    const first = await getPrs();
+    assert.equal(first.error, undefined);
+    assert.equal(first.prs.length, 1);
+    // Second request — should be served from cache, no additional exec call
+    const second = await getPrs();
+    assert.equal(second.error, undefined);
+    assert.equal(second.prs.length, 1);
+    assert.equal(searchCallCount, 1, 'gh search should have been called exactly once (cache hit on second request)');
+});
+test('uses GraphQL path when github accessToken is in config', async () => {
+    // Use an isolated tmp dir, config, and server so this test does not
+    // interfere with the shared server used by the other tests.
+    const gqlTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'org-dashboard-gql-test-'));
+    const gqlConfigPath = path.join(gqlTmpDir, 'config.json');
+    saveConfig(gqlConfigPath, {
+        ...DEFAULTS,
+        repos: [WORKSPACE_PATH_A],
+        github: { accessToken: 'ghp_test123', username: 'graphqluser' },
+    });
+    const graphqlPr = {
+        number: 99,
+        title: 'GraphQL PR',
+        url: 'https://github.com/myorg/repo-a/pull/99',
+        headRefName: 'feat/graphql',
+        baseRefName: 'main',
+        state: 'OPEN',
+        author: 'graphqluser',
+        role: 'author',
+        updatedAt: '2026-03-22T00:00:00Z',
+        additions: 5,
+        deletions: 2,
+        reviewDecision: null,
+        mergeable: null,
+        isDraft: false,
+        ciStatus: null,
+        repoName: 'repo-a',
+        repoPath: WORKSPACE_PATH_A,
+    };
+    let graphqlCallCount = 0;
+    let capturedToken;
+    let capturedRepoMap;
+    const mockFetchGraphQL = async (token, repoMap) => {
+        graphqlCallCount++;
+        capturedToken = token;
+        capturedRepoMap = repoMap;
+        return { prs: [graphqlPr], username: 'graphqluser' };
+    };
+    // exec mock that handles git remote but should NOT be called for gh user/search
+    const exec = makeMockExec({
+        remotes: { [WORKSPACE_PATH_A]: 'git@github.com:myorg/repo-a.git' },
+    });
+    let gqlServer;
+    let gqlBaseUrl;
+    await new Promise((resolve) => {
+        const app = express();
+        app.use(express.json());
+        const deps = {
+            configPath: gqlConfigPath,
+            execAsync: exec,
+            fetchGraphQL: mockFetchGraphQL,
+        };
+        app.use('/org-dashboard', createOrgDashboardRouter(deps));
+        gqlServer = app.listen(0, '127.0.0.1', () => {
+            const addr = gqlServer.address();
+            if (typeof addr === 'object' && addr) {
+                gqlBaseUrl = `http://127.0.0.1:${addr.port}`;
+            }
+            resolve();
+        });
+    });
+    try {
+        const res = await fetch(`${gqlBaseUrl}/org-dashboard/prs`);
+        const data = (await res.json());
+        assert.equal(data.error, undefined, `Unexpected error: ${data.error}`);
+        assert.equal(data.prs.length, 1, 'Should return the GraphQL PR');
+        assert.equal(data.prs[0]?.number, 99, 'PR number should match GraphQL data');
+        assert.equal(data.prs[0]?.title, 'GraphQL PR');
+        assert.equal(graphqlCallCount, 1, 'fetchGraphQL should have been called exactly once');
+        assert.equal(capturedToken, 'ghp_test123', 'fetchGraphQL should receive the configured access token');
+        assert.ok(capturedRepoMap instanceof Map, 'fetchGraphQL should receive the repoMap');
+    }
+    finally {
+        await new Promise((resolve) => {
+            if (gqlServer)
+                gqlServer.close(() => resolve());
+            else
+                resolve();
+        });
+        fs.rmSync(gqlTmpDir, { recursive: true, force: true });
+    }
+});

package/dist/test/output-parser.test.js

@@ -0,0 +1,217 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { ClaudeOutputParser } from '../server/output-parsers/claude-parser.js';
+import { CodexOutputParser } from '../server/output-parsers/codex-parser.js';
+import { OpencodeOutputParser } from '../server/output-parsers/opencode-parser.js';
+import { NullOutputParser } from '../server/output-parsers/null-parser.js';
+import { outputParsers } from '../server/output-parsers/index.js';
+describe('ClaudeOutputParser', () => {
+    it('starts in initializing state', () => {
+        const parser = new ClaudeOutputParser();
+        assert.equal(parser.state, 'initializing');
+    });
+    it('transitions to waiting-for-input on > prompt', () => {
+        const parser = new ClaudeOutputParser();
+        const result = parser.onData('>\n', []);
+        assert.deepEqual(result, { state: 'waiting-for-input' });
+    });
+    it('transitions to waiting-for-input on greeting', () => {
+        const parser = new ClaudeOutputParser();
+        const result = parser.onData('How can I help you today?', []);
+        assert.deepEqual(result, { state: 'waiting-for-input' });
+    });
+    it('transitions to processing after first prompt when output arrives', () => {
+        const parser = new ClaudeOutputParser();
+        // First: see the prompt
+        parser.onData('>\n', []);
+        // Then: output starts
+        const result = parser.onData('I will help you with that task...', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('transitions back to waiting-for-input after processing', () => {
+        const parser = new ClaudeOutputParser();
+        parser.onData('>\n', []);
+        parser.onData('Working on it...', []);
+        const result = parser.onData('>\n', []);
+        assert.deepEqual(result, { state: 'waiting-for-input' });
+    });
+    it('detects permission prompt', () => {
+        const parser = new ClaudeOutputParser();
+        parser.onData('>\n', []);
+        const result = parser.onData('Allow tool access to /usr/bin? Allow / Deny', []);
+        assert.deepEqual(result, { state: 'permission-prompt' });
+    });
+    it('detects error state', () => {
+        const parser = new ClaudeOutputParser();
+        parser.onData('>\n', []);
+        const result = parser.onData('Error: something went wrong', []);
+        assert.deepEqual(result, { state: 'error' });
+    });
+    it('ignores pure ANSI escape sequences', () => {
+        const parser = new ClaudeOutputParser();
+        const result = parser.onData('\x1b[32m\x1b[0m', []);
+        assert.equal(result, null);
+    });
+    it('returns null when state does not change', () => {
+        const parser = new ClaudeOutputParser();
+        parser.onData('>\n', []);
+        // Already in waiting-for-input, send another prompt
+        const result = parser.onData('>\n', []);
+        assert.equal(result, null);
+    });
+    it('reset returns to initializing', () => {
+        const parser = new ClaudeOutputParser();
+        parser.onData('>\n', []);
+        assert.equal(parser.state, 'waiting-for-input');
+        parser.reset();
+        assert.equal(parser.state, 'initializing');
+    });
+    it('stays initializing before first prompt', () => {
+        const parser = new ClaudeOutputParser();
+        const result = parser.onData('Loading configuration...', []);
+        // Still initializing since no prompt seen
+        assert.equal(result, null); // already in initializing, no change
+    });
+});
+describe('CodexOutputParser', () => {
+    it('always returns null', () => {
+        const parser = new CodexOutputParser();
+        assert.equal(parser.onData('any output', []), null);
+        assert.equal(parser.onData('>\n', []), null);
+        assert.equal(parser.onData('Error: something', []), null);
+    });
+    it('reset is a no-op', () => {
+        const parser = new CodexOutputParser();
+        parser.reset(); // should not throw
+    });
+});
+describe('outputParsers registry', () => {
+    it('creates ClaudeOutputParser for claude', () => {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const parser = outputParsers['claude']();
+        assert.ok(parser instanceof ClaudeOutputParser);
+    });
+    it('creates CodexOutputParser for codex', () => {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const parser = outputParsers['codex']();
+        assert.ok(parser instanceof CodexOutputParser);
+    });
+    it('creates OpencodeOutputParser for opencode', () => {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const parser = outputParsers['opencode']();
+        assert.ok(parser instanceof OpencodeOutputParser);
+    });
+    it('creates NullOutputParser for none', () => {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const parser = outputParsers['none']();
+        assert.ok(parser instanceof NullOutputParser);
+    });
+    it('returns undefined for unknown keys', () => {
+        assert.equal(outputParsers['unknown-agent-xyz'], undefined);
+    });
+});
+describe('NullOutputParser', () => {
+    it('always returns null for any input', () => {
+        const parser = new NullOutputParser();
+        assert.equal(parser.onData('any output', []), null);
+        assert.equal(parser.onData('>\n', []), null);
+        assert.equal(parser.onData('Error: something', []), null);
+        assert.equal(parser.onData('', []), null);
+    });
+    it('reset is a no-op', () => {
+        const parser = new NullOutputParser();
+        parser.reset(); // should not throw
+    });
+});
+describe('OpencodeOutputParser', () => {
+    it('starts in initializing state', () => {
+        const parser = new OpencodeOutputParser();
+        assert.equal(parser.state, 'initializing');
+    });
+    it('detects permission prompt from ! permission requested line', () => {
+        const parser = new OpencodeOutputParser();
+        const result = parser.onData('! permission requested: bash (*); allow this tool?', []);
+        assert.deepEqual(result, { state: 'permission-prompt' });
+    });
+    it('recognizes agent header and sets hasSeenFirstPrompt (no state change from initializing)', () => {
+        const parser = new OpencodeOutputParser();
+        // Parser starts in initializing; header keeps it in initializing — no state change, returns null
+        const result = parser.onData('> build . anthropic/claude-sonnet-4-5', []);
+        assert.equal(result, null);
+        assert.equal(parser.state, 'initializing');
+    });
+    it('detects bash tool icon as processing', () => {
+        const parser = new OpencodeOutputParser();
+        // Simulate having seen first prompt first
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        // Now a bash tool invocation
+        const result = parser.onData('$ npm run build', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('detects file edit tool icon as processing', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        const result = parser.onData('<- src/index.ts', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('detects file read tool icon as processing', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        const result = parser.onData('-> src/index.ts', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('detects glob/grep tool icon as processing', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        const result = parser.onData('* **/*.ts', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('detects webfetch tool icon as processing', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        const result = parser.onData('% https://example.com', []);
+        assert.deepEqual(result, { state: 'processing' });
+    });
+    it('detects waiting-for-input on > prompt without provider info', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        parser.onData('$ npm install', []);
+        const result = parser.onData('>\n', []);
+        assert.deepEqual(result, { state: 'waiting-for-input' });
+    });
+    it('detects waiting-for-input on "Ready" pattern', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        parser.onData('doing work...', []);
+        const result = parser.onData('Ready', []);
+        assert.deepEqual(result, { state: 'waiting-for-input' });
+    });
+    it('strips ANSI sequences before matching', () => {
+        const parser = new OpencodeOutputParser();
+        // Pure ANSI should return null
+        const result = parser.onData('\x1b[32m\x1b[0m', []);
+        assert.equal(result, null);
+    });
+    it('permission prompt has highest priority over processing', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        // Even if there is tool-like content, the permission pattern wins
+        const result = parser.onData('! permission requested: bash (*); $ npm run test', []);
+        assert.deepEqual(result, { state: 'permission-prompt' });
+    });
+    it('returns null when state does not change', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        // Still initializing, another header line should return null (already initializing)
+        const result = parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        assert.equal(result, null);
+    });
+    it('reset returns to initializing state', () => {
+        const parser = new OpencodeOutputParser();
+        parser.onData('> build . anthropic/claude-3-5-sonnet', []);
+        parser.onData('>\n', []);
+        assert.equal(parser.state, 'waiting-for-input');
+        parser.reset();
+        assert.equal(parser.state, 'initializing');
+    });
+});

package/dist/test/paths.test.js

@@ -0,0 +1,32 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+// At runtime, __dirname resolves to dist/test/.
+// The server runs from dist/server/, which uses path.join(__dirname, '..', '..', ...)
+// to reach the project root. This test verifies that relationship is correct.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// This test file is at dist/test/, server is at dist/server/ — same depth
+const projectRoot = path.resolve(__dirname, '..', '..');
+test('project root from dist/ contains frontend/ directory', () => {
+    const frontendDir = path.join(projectRoot, 'frontend');
+    assert.ok(fs.existsSync(frontendDir), `Expected frontend/ at ${frontendDir}`);
+});
+test('project root from dist/ contains frontend/index.html', () => {
+    const indexHtml = path.join(projectRoot, 'frontend', 'index.html');
+    assert.ok(fs.existsSync(indexHtml), `Expected frontend/index.html at ${indexHtml}`);
+});
+test('dist/server/ exists after compilation', () => {
+    const serverDir = path.join(projectRoot, 'dist', 'server');
+    assert.ok(fs.existsSync(serverDir), `Expected dist/server/ at ${serverDir}`);
+});
+test('server index.ts uses correct path depth to reach dist/frontend/', async () => {
+    // Read the source file and verify the path pattern
+    const indexSource = fs.readFileSync(path.join(projectRoot, 'server', 'index.ts'), 'utf8');
+    // Static serving must go up one level from dist/server/ to dist/, then into frontend/
+    assert.ok(indexSource.includes("path.join(__dirname, '..', 'frontend')"), 'express.static must resolve dist/frontend/ one level up from dist/server/');
+    // Config fallback must also go up two levels
+    assert.ok(indexSource.includes("path.join(__dirname, '..', '..', 'config.json')"), 'CONFIG_PATH must resolve config.json two levels up from dist/server/');
+});