stagent 0.10.0 → 0.11.1

package/src/lib/chat/__tests__/active-skill-injection.test.ts

@@ -0,0 +1,261 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const { mockState } = vi.hoisted(() => ({
+  mockState: {
+    activeSkillId: null as string | null,
+    activeSkillIds: [] as string[],
+    skills: {} as Record<string, { name: string; content: string }>,
+    runtimeId: "ollama" as string, // default: Ollama (stagentInjectsSkills: true)
+  },
+}));
+
+// ── Mocks ──────────────────────────────────────────────────────────────
+
+vi.mock("@/lib/db", () => ({
+  db: {
+    select: () => ({
+      from() {
+        return this;
+      },
+      where() {
+        return this;
+      },
+      get() {
+        return Promise.resolve({
+          activeSkillId: mockState.activeSkillId,
+          activeSkillIds: mockState.activeSkillIds,
+          runtimeId: mockState.runtimeId,
+        });
+      },
+    }),
+  },
+}));
+
+vi.mock("@/lib/db/schema", () => ({
+  conversations: {
+    id: "id",
+    activeSkillId: "activeSkillId",
+    activeSkillIds: "activeSkillIds",
+    runtimeId: "runtimeId",
+  },
+  projects: { id: "id" },
+  tasks: { id: "id" },
+  workflows: { id: "id" },
+  documents: { id: "id" },
+  schedules: { id: "id" },
+}));
+
+vi.mock("drizzle-orm", () => ({
+  eq: () => ({}),
+  desc: () => ({}),
+  and: () => ({}),
+}));
+
+vi.mock("@/lib/data/chat", () => ({
+  getMessages: async () => [],
+}));
+
+vi.mock("@/lib/agents/profiles/registry", () => ({
+  getProfile: () => null,
+}));
+
+vi.mock("@/lib/environment/list-skills", () => ({
+  getSkill: (id: string) => {
+    const skill = mockState.skills[id];
+    if (!skill) return null;
+    return {
+      id,
+      name: skill.name,
+      tool: "claude-code",
+      scope: "project",
+      preview: "",
+      sizeBytes: Buffer.byteLength(skill.content),
+      absPath: "/mock/path/SKILL.md",
+      content: skill.content,
+    };
+  },
+}));
+
+import { buildChatContext } from "../context-builder";
+
+beforeEach(() => {
+  mockState.activeSkillId = null;
+  mockState.activeSkillIds = [];
+  mockState.skills = {};
+  mockState.runtimeId = "ollama";
+});
+
+describe("active skill Tier 0 injection", () => {
+  it("does NOT inject anything when activeSkillId is null (common case)", async () => {
+    const ctx = await buildChatContext({ conversationId: "conv-1" });
+    expect(ctx.systemPrompt).not.toContain("## Active Skill:");
+  });
+
+  it("injects the skill's SKILL.md content under an Active Skill header when bound", async () => {
+    mockState.activeSkillId = ".claude/skills/capture";
+    mockState.skills[".claude/skills/capture"] = {
+      name: "capture",
+      content: "# capture\n\nCapture web content as markdown.",
+    };
+
+    const ctx = await buildChatContext({ conversationId: "conv-1" });
+    expect(ctx.systemPrompt).toContain("## Active Skill: capture");
+    expect(ctx.systemPrompt).toContain("Capture web content as markdown");
+  });
+
+  it("silently emits no section when the bound skill id is not found (skill deleted)", async () => {
+    mockState.activeSkillId = "dangling-id";
+    const ctx = await buildChatContext({ conversationId: "conv-1" });
+    expect(ctx.systemPrompt).not.toContain("## Active Skill:");
+  });
+
+  it("caps very large SKILL.md content to the token budget", async () => {
+    mockState.activeSkillId = "huge-skill";
+    mockState.skills["huge-skill"] = {
+      name: "capture",
+      content: "A".repeat(100_000), // ~25K tokens at 4 chars/token
+    };
+    const ctx = await buildChatContext({ conversationId: "conv-1" });
+    // Budget is 4_000 tokens = ~16_000 chars; expect truncation marker
+    expect(ctx.systemPrompt).toContain("...(truncated)");
+    // Full 100K chars must NOT be inline
+    expect(ctx.systemPrompt.length).toBeLessThan(50_000);
+  });
+
+  describe("runtime capability flag (stagentInjectsSkills)", () => {
+    it("does NOT inject on claude-code (native skill support — would duplicate)", async () => {
+      mockState.runtimeId = "claude-code";
+      mockState.activeSkillId = ".claude/skills/capture";
+      mockState.skills[".claude/skills/capture"] = {
+        name: "capture",
+        content: "# capture\n\nBody.",
+      };
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).not.toContain("## Active Skill:");
+      expect(ctx.systemPrompt).not.toContain("Body.");
+    });
+
+    it("does inject composed skills on claude-code when activeSkillIds are set", async () => {
+      mockState.runtimeId = "claude-code";
+      mockState.activeSkillId = ".claude/skills/researcher";
+      mockState.activeSkillIds = [".claude/skills/technical-writer"];
+      mockState.skills[".claude/skills/researcher"] = {
+        name: "researcher",
+        content: "Always gather sources first.",
+      };
+      mockState.skills[".claude/skills/technical-writer"] = {
+        name: "technical-writer",
+        content: "Prefer crisp, publishable prose.",
+      };
+
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).toContain("## Active Skill: researcher");
+      expect(ctx.systemPrompt).toContain("## Active Skill: technical-writer");
+    });
+
+    it("does NOT inject on openai-codex-app-server (native skill support — would duplicate)", async () => {
+      mockState.runtimeId = "openai-codex-app-server";
+      mockState.activeSkillId = ".agents/skills/capture";
+      mockState.skills[".agents/skills/capture"] = {
+        name: "capture",
+        content: "# capture\n\nBody.",
+      };
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).not.toContain("## Active Skill:");
+    });
+
+    it("DOES inject on ollama (no native support — Stagent must inject)", async () => {
+      mockState.runtimeId = "ollama";
+      mockState.activeSkillId = ".claude/skills/capture";
+      mockState.skills[".claude/skills/capture"] = {
+        name: "capture",
+        content: "# capture\n\nOllama needs this.",
+      };
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).toContain("## Active Skill: capture");
+      expect(ctx.systemPrompt).toContain("Ollama needs this.");
+    });
+
+    it("falls through and injects when runtimeId is unknown (safer default than dropping)", async () => {
+      mockState.runtimeId = "some-future-runtime-not-in-catalog";
+      mockState.activeSkillId = ".claude/skills/capture";
+      mockState.skills[".claude/skills/capture"] = {
+        name: "capture",
+        content: "# capture\n\nBody.",
+      };
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      // Unknown runtime → catalog throws → catch → fall through to injection.
+      expect(ctx.systemPrompt).toContain("## Active Skill: capture");
+    });
+  });
+
+  describe("composition budget trimming", () => {
+    it("keeps multiple composed skills when the combined payload fits", async () => {
+      mockState.runtimeId = "claude-code";
+      mockState.activeSkillId = ".claude/skills/researcher";
+      mockState.activeSkillIds = [".claude/skills/technical-writer"];
+      mockState.skills[".claude/skills/researcher"] = {
+        name: "researcher",
+        content: "Collect sources.",
+      };
+      mockState.skills[".claude/skills/technical-writer"] = {
+        name: "technical-writer",
+        content: "Write clearly.",
+      };
+
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).toContain("## Active Skill: researcher");
+      expect(ctx.systemPrompt).toContain("## Active Skill: technical-writer");
+      expect(ctx.systemPrompt).not.toContain("## Active Skill Note");
+    });
+
+    it("omits oldest composed skills first when the combined payload exceeds budget", async () => {
+      mockState.runtimeId = "claude-code";
+      mockState.activeSkillId = ".claude/skills/oldest";
+      mockState.activeSkillIds = [
+        ".claude/skills/middle",
+        ".claude/skills/newest",
+      ];
+      mockState.skills[".claude/skills/oldest"] = {
+        name: "oldest",
+        content: "O".repeat(8_000),
+      };
+      mockState.skills[".claude/skills/middle"] = {
+        name: "middle",
+        content: "M".repeat(8_000),
+      };
+      mockState.skills[".claude/skills/newest"] = {
+        name: "newest",
+        content: "N".repeat(2_000),
+      };
+
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).toContain("## Active Skill Note");
+      expect(ctx.systemPrompt).toContain("Omitted 1 older active skill to fit the prompt budget: oldest.");
+      expect(ctx.systemPrompt).not.toContain("## Active Skill: oldest");
+      expect(ctx.systemPrompt).toContain("## Active Skill: middle");
+      expect(ctx.systemPrompt).toContain("## Active Skill: newest");
+    });
+
+    it("truncates the newest remaining skill when even one section exceeds budget", async () => {
+      mockState.runtimeId = "claude-code";
+      mockState.activeSkillId = ".claude/skills/oldest";
+      mockState.activeSkillIds = [".claude/skills/newest"];
+      mockState.skills[".claude/skills/oldest"] = {
+        name: "oldest",
+        content: "O".repeat(8_000),
+      };
+      mockState.skills[".claude/skills/newest"] = {
+        name: "newest",
+        content: "N".repeat(40_000),
+      };
+
+      const ctx = await buildChatContext({ conversationId: "conv-1" });
+      expect(ctx.systemPrompt).toContain("## Active Skill Note");
+      expect(ctx.systemPrompt).toContain("oldest");
+      expect(ctx.systemPrompt).toContain("## Active Skill: newest");
+      expect(ctx.systemPrompt).toContain("...(truncated)");
+      expect(ctx.systemPrompt).not.toContain("## Active Skill: oldest");
+    });
+  });
+});

package/src/lib/chat/__tests__/clean-filter-input.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from "vitest";
+import { cleanFilterInput } from "../clean-filter-input";
+import { parseFilterInput } from "@/lib/filters/parse";
+
+// Smoke through the full chain: parse the raw popover input, then clean
+// the result. Mirrors what `chat-command-popover.tsx` does at the
+// SaveViewFooter call site so the assertions catch any regression in
+// either the parser OR the cleaner.
+function persisted(input: string): string {
+  const parsed = parseFilterInput(input);
+  return cleanFilterInput(parsed.clauses, parsed.rawQuery);
+}
+
+describe("cleanFilterInput", () => {
+  it("strips bare mention-trigger prefix from clauses-only input", () => {
+    expect(persisted("@task: #priority:high")).toBe("#priority:high");
+  });
+
+  it("strips trigger prefix and preserves free text", () => {
+    // Order: clauses first, then rawQuery — matches the cleaner's
+    // documented behavior.
+    expect(persisted("@task: foo #priority:high")).toBe(
+      "#priority:high foo"
+    );
+  });
+
+  it("leaves clean inputs untouched (no trigger residue)", () => {
+    expect(persisted("#status:blocked")).toBe("#status:blocked");
+    expect(persisted("#status:blocked #priority:high")).toBe(
+      "#status:blocked #priority:high"
+    );
+  });
+
+  it("preserves multi-word free text", () => {
+    expect(persisted('@project: my big query #status:active')).toBe(
+      "#status:active my big query"
+    );
+  });
+
+  it("never emits ':' not preceded by '#' (regression assertion)", () => {
+    const tricky = [
+      "@task: #status:blocked",
+      "@project: foo #status:active",
+      "@workflow: #status:running #priority:high",
+      "#status:blocked",
+    ];
+    for (const input of tricky) {
+      const result = persisted(input);
+      // After every ':' there must be a non-':' char, and every ':' must
+      // be immediately preceded by either an alpha char (the key) or
+      // we expect the form #key:value. Simpler: assert no occurrence of
+      // ': ' (trigger residue always has a trailing space) and no
+      // alpha-only-prefix-colon at the start.
+      expect(result).not.toMatch(/^[a-z]+:\s/i);
+    }
+  });
+
+  it("handles empty clauses + empty rawQuery", () => {
+    expect(cleanFilterInput([], "")).toBe("");
+  });
+
+  it("handles clauses + only-trigger rawQuery", () => {
+    // `@task:` with no other input → rawQuery is `@task:` → cleaned to ""
+    expect(cleanFilterInput([{ key: "status", value: "blocked" }], "@task:")).toBe(
+      "#status:blocked"
+    );
+  });
+});

package/src/lib/chat/__tests__/command-tabs.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from "vitest";
+import {
+  COMMAND_TABS,
+  GROUP_TO_TAB,
+  partitionCatalogByTab,
+  isCommandTabId,
+  type CommandTabId,
+} from "../command-tabs";
+import type { ToolCatalogEntry, ToolGroup } from "../tool-catalog";
+
+const entry = (name: string, group: ToolGroup): ToolCatalogEntry => ({
+  name,
+  description: name,
+  group,
+});
+
+describe("command-tabs", () => {
+  it("exposes four tabs in canonical order", () => {
+    expect(COMMAND_TABS.map((t) => t.id)).toEqual([
+      "actions",
+      "skills",
+      "tools",
+      "entities",
+    ]);
+  });
+
+  it("maps every ToolGroup to exactly one tab", () => {
+    const groups: ToolGroup[] = [
+      "Session", "Tasks", "Projects", "Workflows", "Schedules", "Documents", "Tables",
+      "Notifications", "Profiles", "Skills", "Usage", "Settings", "Chat",
+      "Browser", "Utility",
+    ];
+    for (const g of groups) {
+      expect(GROUP_TO_TAB[g]).toBeDefined();
+    }
+  });
+
+  it("routes Session group to the Actions tab", () => {
+    expect(GROUP_TO_TAB.Session).toBe("actions");
+  });
+
+  it("routes Skills group to the Skills tab", () => {
+    expect(GROUP_TO_TAB.Skills).toBe("skills");
+  });
+
+  it("routes Browser + Utility to the Tools tab", () => {
+    expect(GROUP_TO_TAB.Browser).toBe("tools");
+    expect(GROUP_TO_TAB.Utility).toBe("tools");
+  });
+
+  it("partitions catalog entries by tab", () => {
+    const catalog: ToolCatalogEntry[] = [
+      entry("list_tasks", "Tasks"),
+      entry("researcher", "Skills"),
+      entry("take_screenshot", "Browser"),
+    ];
+    const part = partitionCatalogByTab(catalog);
+    expect(part.actions.map((e) => e.name)).toEqual(["list_tasks"]);
+    expect(part.skills.map((e) => e.name)).toEqual(["researcher"]);
+    expect(part.tools.map((e) => e.name)).toEqual(["take_screenshot"]);
+    expect(part.entities).toEqual([]);
+  });
+
+  it("isCommandTabId rejects unknown values", () => {
+    expect(isCommandTabId("actions")).toBe(true);
+    expect(isCommandTabId("random")).toBe(false);
+  });
+});

package/src/lib/chat/__tests__/context-builder-files.test.ts

@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const { mockFs } = vi.hoisted(() => ({
+  mockFs: {
+    realpathMap: new Map<string, string>(),
+    files: new Map<string, string>(),
+    statMap: new Map<string, { size: number }>(),
+  },
+}));
+
+vi.mock("node:fs", () => {
+  const realpathSync = (p: string) => {
+    const real = mockFs.realpathMap.get(p);
+    if (real === undefined) throw new Error(`ENOENT: realpath ${p}`);
+    return real;
+  };
+  const statSync = (p: string) => {
+    const s = mockFs.statMap.get(p);
+    if (!s) throw new Error(`ENOENT: stat ${p}`);
+    return s;
+  };
+  const readFileSync = (p: string) => {
+    const content = mockFs.files.get(p);
+    if (content === undefined) throw new Error(`ENOENT: read ${p}`);
+    return content;
+  };
+  return {
+    default: { realpathSync, statSync, readFileSync },
+    realpathSync,
+    statSync,
+    readFileSync,
+  };
+});
+
+import { expandFileMention } from "../files/expand-mention";
+
+const CWD = "/repo";
+
+beforeEach(() => {
+  mockFs.realpathMap.clear();
+  mockFs.files.clear();
+  mockFs.statMap.clear();
+  mockFs.realpathMap.set(CWD, CWD);
+});
+
+function registerFile(relPath: string, content: string) {
+  const abs = `${CWD}/${relPath}`;
+  mockFs.files.set(abs, content);
+  mockFs.statMap.set(abs, { size: Buffer.byteLength(content, "utf8") });
+}
+
+describe("expandFileMention", () => {
+  it("inlines files under 8 KB with a path header and fenced code block", () => {
+    registerFile("src/a.ts", "export const x = 1;\n");
+    const out = expandFileMention("src/a.ts", CWD).join("\n");
+    expect(out).toContain("### File: src/a.ts");
+    expect(out).toContain("```ts");
+    expect(out).toContain("export const x = 1;");
+    expect(out).toContain("```");
+  });
+
+  it("references files >= 8 KB without inlining their content", () => {
+    const big = "A".repeat(10 * 1024);
+    registerFile("docs/large.md", big);
+    const out = expandFileMention("docs/large.md", CWD).join("\n");
+    expect(out).toContain("File (by reference): docs/large.md");
+    expect(out).toContain("KB)"); // size hint
+    expect(out).toContain("Use the Read tool");
+    expect(out).not.toContain(big); // content not inlined
+  });
+
+  it("emits a not-found note when the file no longer exists", () => {
+    const out = expandFileMention("src/gone.ts", CWD).join("\n");
+    expect(out).toContain("### File: src/gone.ts");
+    expect(out).toContain("(file not found at context-build time)");
+  });
+
+  it("rejects paths that resolve outside cwd (security guardrail)", () => {
+    const out = expandFileMention("../escape.ts", CWD).join("\n");
+    expect(out).toContain("(invalid path — escapes working directory)");
+    expect(out).not.toContain("(file not found"); // did not even try to read
+  });
+
+  it("skips pathological files >= 50 MB silently (returns empty)", () => {
+    const abs = `${CWD}/huge.bin`;
+    mockFs.statMap.set(abs, { size: 60 * 1024 * 1024 });
+    // readFileSync is never reached
+    const out = expandFileMention("huge.bin", CWD);
+    expect(out).toEqual([]);
+  });
+
+  it("picks an 'unknown' code-fence language for files without an extension", () => {
+    const abs = `${CWD}/Makefile`;
+    mockFs.files.set(abs, "all:\n\techo ok\n");
+    mockFs.statMap.set(abs, { size: 16 });
+    const out = expandFileMention("Makefile", CWD).join("\n");
+    // .split(".").pop() on a name with no dot returns the whole name,
+    // which is the best we can do without a language map. We just
+    // assert a header + a closing fence are present.
+    expect(out).toContain("### File: Makefile");
+    expect(out).toMatch(/```[\w]*/);
+    expect(out).toContain("all:");
+  });
+
+  it("emits a read-failure note if the file stats OK but reads throw", () => {
+    const abs = `${CWD}/src/binary.ico`;
+    mockFs.statMap.set(abs, { size: 100 });
+    // Do NOT register contents — readFileSync will throw
+    const out = expandFileMention("src/binary.ico", CWD).join("\n");
+    expect(out).toContain("(file could not be read as UTF-8)");
+  });
+});

package/src/lib/chat/__tests__/dismissals.test.ts

@@ -0,0 +1,65 @@
+import { describe, it, expect } from "vitest";
+import {
+  loadDismissals,
+  saveDismissal,
+  activeDismissedIds,
+  DISMISSAL_TTL_MS,
+} from "../dismissals";
+
+type Store = { read: () => string | null; write: (v: string) => void };
+
+function mockStore(initial: string | null = null): Store {
+  let v = initial;
+  return {
+    read: () => v,
+    write: (next) => {
+      v = next;
+    },
+  };
+}
+
+describe("dismissals", () => {
+  const NOW = 1_700_000_000_000;
+
+  it("returns empty when store is null", () => {
+    const store = mockStore();
+    const all = loadDismissals(store);
+    expect(all).toEqual({});
+  });
+
+  it("saves dismissals keyed by conversation + skill", () => {
+    const store = mockStore();
+    saveDismissal(store, "conv-1", "skill-a", NOW);
+    const all = loadDismissals(store);
+    expect(all["conv-1"]["skill-a"]).toBe(NOW);
+  });
+
+  it("activeDismissedIds excludes expired entries", () => {
+    const store = mockStore();
+    saveDismissal(store, "c1", "fresh", NOW);
+    saveDismissal(store, "c1", "old", NOW - DISMISSAL_TTL_MS - 1000);
+    const ids = activeDismissedIds(store, "c1", NOW);
+    expect(ids.has("fresh")).toBe(true);
+    expect(ids.has("old")).toBe(false);
+  });
+
+  it("returns empty set when conversation has no dismissals", () => {
+    const store = mockStore();
+    expect(activeDismissedIds(store, "never-seen", NOW).size).toBe(0);
+  });
+
+  it("silently tolerates store write errors", () => {
+    const store: Store = {
+      read: () => null,
+      write: () => {
+        throw new Error("quota");
+      },
+    };
+    expect(() => saveDismissal(store, "c1", "s1", NOW)).not.toThrow();
+  });
+
+  it("silently tolerates corrupt JSON on read", () => {
+    const store = mockStore("not-json");
+    expect(loadDismissals(store)).toEqual({});
+  });
+});

package/src/lib/chat/__tests__/engine-sdk-options.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it } from "vitest";
+import {
+  CLAUDE_SDK_ALLOWED_TOOLS,
+  CLAUDE_SDK_SETTING_SOURCES,
+  CLAUDE_SDK_READ_ONLY_FS_TOOLS,
+} from "@/lib/chat/engine";
+
+describe("Claude SDK options (Phase 1a)", () => {
+  it("declares settingSources loading user and project config", () => {
+    expect(CLAUDE_SDK_SETTING_SOURCES).toEqual(["user", "project"]);
+  });
+
+  it("includes Skill, filesystem tools, Bash, and TodoWrite in allowedTools", () => {
+    expect(CLAUDE_SDK_ALLOWED_TOOLS).toEqual(
+      expect.arrayContaining([
+        "Skill",
+        "Read",
+        "Grep",
+        "Glob",
+        "Edit",
+        "Write",
+        "Bash",
+        "TodoWrite",
+      ])
+    );
+  });
+
+  it("does NOT include Task (subagent delegation replaced by Stagent primitives)", () => {
+    expect(CLAUDE_SDK_ALLOWED_TOOLS).not.toContain("Task");
+  });
+
+  it("declares Read, Grep, Glob as read-only filesystem tools", () => {
+    expect(CLAUDE_SDK_READ_ONLY_FS_TOOLS).toEqual(
+      new Set(["Read", "Grep", "Glob"])
+    );
+  });
+
+  it("does NOT treat Edit, Write, Bash, or TodoWrite as read-only", () => {
+    for (const tool of ["Edit", "Write", "Bash", "TodoWrite"]) {
+      expect(CLAUDE_SDK_READ_ONLY_FS_TOOLS.has(tool)).toBe(false);
+    }
+  });
+});
+
+import { canUseToolForTest } from "@/lib/chat/engine";
+
+describe("canUseTool auto-allow policy for SDK filesystem tools", () => {
+  it("auto-allows Read without a permission request", async () => {
+    const result = await canUseToolForTest("Read", { file_path: "/tmp/x" });
+    expect(result.behavior).toBe("allow");
+  });
+
+  it("auto-allows Grep without a permission request", async () => {
+    const result = await canUseToolForTest("Grep", { pattern: "foo" });
+    expect(result.behavior).toBe("allow");
+  });
+
+  it("auto-allows Glob without a permission request", async () => {
+    const result = await canUseToolForTest("Glob", { pattern: "**/*.ts" });
+    expect(result.behavior).toBe("allow");
+  });
+
+  it("auto-allows Skill tool invocation", async () => {
+    const result = await canUseToolForTest("Skill", { skill: "code-reviewer" });
+    expect(result.behavior).toBe("allow");
+  });
+
+  it("does NOT auto-allow Edit (must go through permission flow)", async () => {
+    const result = await canUseToolForTest("Edit", { file_path: "/tmp/x", content: "y" });
+    expect(result.behavior).not.toBe("allow");
+  });
+
+  it("does NOT auto-allow Bash", async () => {
+    const result = await canUseToolForTest("Bash", { command: "ls" });
+    expect(result.behavior).not.toBe("allow");
+  });
+});
+
+describe("hooks excluded per Q2", () => {
+  it("does not declare a hooks field alongside settingSources", async () => {
+    const fs = await import("fs");
+    const path = await import("path");
+    const enginePath = path.resolve(__dirname, "../engine.ts");
+    const source = fs.readFileSync(enginePath, "utf8");
+    // Assert that within the query() options block, there is no `hooks:` field.
+    // This is a regex-level check because the options object is inline literals.
+    const optionsBlock = source.match(/query\(\s*\{[\s\S]*?\}\s*\)/)?.[0] ?? "";
+    expect(optionsBlock).toContain("settingSources");
+    expect(optionsBlock).not.toMatch(/\bhooks\s*:/);
+  });
+});
+
+describe("CLAUDE_SDK_* constants source-of-truth", () => {
+  it("exports CLAUDE_SDK_ALLOWED_TOOLS from runtime/claude-sdk", async () => {
+    const mod = await import("@/lib/agents/runtime/claude-sdk");
+    expect(mod.CLAUDE_SDK_ALLOWED_TOOLS).toEqual([
+      "Skill",
+      "Read",
+      "Grep",
+      "Glob",
+      "Edit",
+      "Write",
+      "Bash",
+      "TodoWrite",
+    ]);
+  });
+
+  it("exports CLAUDE_SDK_SETTING_SOURCES from runtime/claude-sdk", async () => {
+    const mod = await import("@/lib/agents/runtime/claude-sdk");
+    expect(mod.CLAUDE_SDK_SETTING_SOURCES).toEqual(["user", "project"]);
+  });
+
+  it("exports CLAUDE_SDK_READ_ONLY_FS_TOOLS from runtime/claude-sdk", async () => {
+    const mod = await import("@/lib/agents/runtime/claude-sdk");
+    expect(mod.CLAUDE_SDK_READ_ONLY_FS_TOOLS).toEqual(new Set(["Read", "Grep", "Glob"]));
+  });
+});